G Suite for Education as SAML identity provider
I got the SAML plugin working with Google's G Suite for Education as a SAML identity provider, although insecurely. I had to manually patch out the Assertion signature check and the SessionIndex attribute, which is Not A Good Thing(TM).
- potentially relevant isue: https://github.com/Clever/saml2/issues/106 seems
- potentially relevant patch merged upstream: https://github.com/oguennec/saml2/pull/1 .
If I were confident I perfectly knew what I was doing here, I would submit a patch, but alas...
Could you please have a look at the relevance of the upstream changes and update the plugin accordingly if necessary? I promise I will test it so you won't have to touch anything Google!
My dirty disable patch to peertube-plugin-auth-saml2/main.js:
` function handleAssert(peertubeHelpers, settingsManager, req, res) { const { logger } = peertubeHelpers
const options = { request_body: req.body, ignore_signature: true, require_session_index: false, } `
Without patching out the assert signature check, I get:
Nov 12 22:48:10 peertube peertube[26491]: [peertube.lusis.eu:443 peertube-plugin-auth-saml2] 2020-11-12 22:48:10.757 #033[31merror#033[39m: Error SAML 2 assert. { Nov 12 22:48:10 peertube peertube[26491]: "err": { Nov 12 22:48:10 peertube peertube[26491]: "stack": "Error: SAML Assertion signature check failed! (Certificate #1 may be invalid. error:0909006C:PEM routines:get_name:no start line\n at /var/www/peertube/versions/peertube-v2.4.0/storage/plugins/node_modules/saml2-js/lib-js/saml2.js:625:24\n at nextTask (/var/www/peertube/versions/peertube-v2.4.0/storage/plugins/node_modules/async/dist/async.js:5324:14)\n at next (/var/www/peertube/versions/peertube-v2.4.0/storage/plugins/node_modules/async/dist/async.js:5331:9)\n at /var/www/peertube/versions/peertube-v2.4.0/storage/plugins/node_modules/async/dist/async.js:969:16\n at /var/www/peertube/versions/peertube-v2.4.0/storage/plugins/node_modules/saml2-js/lib-js/saml2.js:609:16\n at Timeout._onTimeout (/var/www/peertube/versions/peertube-v2.4.0/storage/plugins/node_modules/saml2-js/lib-js/saml2.js:321:17)\n at listOnTimeout (internal/timers.js:554:17)\n at processTimers (internal/timers.js:497:7)", Nov 12 22:48:10 peertube peertube[26491]: "message": "SAML Assertion signature check failed! (Certificate #1 may be invalid. error:0909006C:PEM routines:get_name:no start line" Nov 12 22:48:10 peertube peertube[26491]: } Nov 12 22:48:10 peertube peertube[26491]: } Nov 12 22:48:10 peertube peertube[26491]: [peertube.lusis.eu:443] 2020-11-12 22:48:10.761 #033[32minfo#033[39m: 94.105.96.108 - - [12/Nov/2020:21:48:10 +0000] "POST /plugins/auth-saml2/router/assert HTTP/1.0" 302 102 "https://accounts.google.com/o/saml2/idp?from_login=1&zt=ChRDTjg3NVNCd1M5TEJzR3JRbkdScRIfazB2R0lqSC13NUFRY0t0V0xtY192ZHE0eTkzbVd4Yw%E2%88%99AF-3PDcAAAAAX67_CDzB6e9VjnaZpv1JPmSOCz71Of64&as=lkC7sqSgBou_8_IAT8OZwg&authuser=0" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36" Nov 12 22:48:10 peertube peertube[26491]: [peertube.lusis.eu:443] 2020-11-12 22:48:10.824 #033[32minfo#033[39m: 94.105.96.108 - - [12/Nov/2020:21:48:10 +0000] "GET /login?externalAuthError=true HTTP/1.0" 304 - "https://accounts.google.com/o/saml2/idp?from_login=1&zt=ChRDTjg3NVNCd1M5TEJzR3JRbkdScRIfazB2R0lqSC13NUFRY0t0V0xtY192ZHE0eTkzbVd4Yw%E2%88%99AF-3PDcAAAAAX67_CDzB6e9VjnaZpv1JPmSOCz71Of64&as=lkC7sqSgBou_8_IAT8OZwg&authuser=0" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36" Nov 12 22:48:11 peertube peertube[26491]: [peertube.lusis.eu:443] 2020-11-12 22:48:11.124 #033[32minfo#033[39m: 94.105.96.108 - - [12/Nov/2020:21:48:11 +0000] "GET /api/v1/config/ HTTP/1.0" 304 - "https://peertube.lusis.eu/login?externalAuthError=true" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36"