cy2_sasl(5)

NAME
cy2_saml - Crude SAML assertion verification plugin for SASL

DESCRIPTION
The cy2_saml is a Simple Authentication Security Layer (SASL) plugin which will validate authentication based on a Security Assertion Markup Language (SAML) authentication assertion. This allows a web server to use the SAML assertion as some kind of ticket for getting authenticated access to some other resource which is protected by SASL.

Of course this authentication scheme is rather clumsy, as the whole security collapse if any valid SAML assertion is known to an attacker. Encrypted communications between client and web server are advised, and cy2_saml also attempts to thwart the most obvious replay attacks, by performing a few checks on the data available in the SAML assertion. The verification performed are:

Identity provider (IdP) signature validity. This prevents an attacker
    from forging a SAML assertion.

Date validity, with a grace period for gracefully handling clock skews.
    This prevents replays using a very old assertion that has been disclosed.

Optionnaly, the IdP-specified assertion audience can be restricted to a
    set of Service Providers (SP). This prevents an attacker from using an assertion collected on an other weak SP that does not use encrypted communications with the client.

SASL CONFIGURATION
Configuration is done in the service configuration file. The following options are available:

saml_compressed_assertion={0|1}
    When decoding the SAML assertion, try to uncompress it (default is not to try). This is only useful if the client is not the SASL plugin.

saml_userid=<uid_attribute>
    Check the value of the uid_attribute attribute in the SAML assertion against the authenticating user login. Default is uid

saml_grace=<time>
    When checking assertion time validity, use a time grace delay (in seconds) to work around minor clock skews. Default it 600s.

saml_check_assertion_timeframe={0|1}
    When checking assertion time validity, check Assertion/Conditions@NotOnOrAfter (Default is to check it).

saml_check_session_timeframe={0|1}
    When checking assertion time validity, check Assertion/AuthnStatement@SessionNotOnOrAfter (Default is to check it).

saml_idp<number>=<path>
    Load SAML metadata for a trusted IdP from path. This option can be used multiple times with number being a unique serial number starting at 0 (ie: use saml_idp0, saml_idp1, saml_idp2, etc), to use several IdP. This option is mandatory, otherwise no assertion will be validated at all.

saml_cacert=<path>
    Use the certificates from path as the certificate authorities. This option cannot be used multiple times, but the certificate file can contain multiple certificates.

saml_trusted_sp=<provider_id>
    In order to be validated, the assertion must have its audience set to provider_id. This is optional and can be specified multiple times. If the option is not specified, the audience is not checked.

AUTHOR
Emmanuel Dreyfus <manu@netbsd.org>

SEE ALSO
sasl(8), pam_saml(5)