How to ~generate~ Validate a SAML Assertion using Apigee

[Sivakrishna_G]

I got a new requirement to Generate and Validate SAML 2.0 token using keyclock idp server. I need to implement this requirement for api authentication flow(Not for SSO). Kindly help me to implement this, Please share if any sample proxy or jar files you have. 

Thanks.

[dchiesa1]

I am not clear whether you want to Generate a SAML token, or verify a SAML token that has been generated by a third-party IDP. 

Just a week ago I answered a question regarding how to Generate a SAML token. Find that discussion here.

[Sivakrishna_G]

Hi Dchiesa1. Thanks for replying. i am trying to use apigee as service provider. i have generated the SAML response from Oauth0 IDP. Now i am trying to validate the saml response using apigee. But i am getting below error.

"fault": {

        "faultstring": "ValidateSAMLAssertion[Validate-SAML-Assertion-1]: Digital Signature Validation Failed",

        "detail": {

            "errorcode": "steps.saml.validate.SignatureValidationFailed"

        }

    }

}

i am using the correct certificate which is added in trust store. But i am getting the above error. Please find the SAMLValidationAssertion configured in my api.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ValidateSAMLAssertion ignoreContentType="false" name="Validate-SAML-Assertion-1">
<DisplayName>Validate SAML Assertion-1</DisplayName>
<Source name="request" ignoreContentType="true">
<Namespaces>
<Namespace prefix="samlp">urn:oasis:names:tc:SAML:2.0:protocol</Namespace>
<Namespace prefix="saml">urn:oasis:names:tc:SAML:2.0:assertion</Namespace>
</Namespaces>
<XPath>/samlp:Response/saml:Assertion</XPath>
</Source>
<TrustStore>Oauth0</TrustStore>
<RemoveAssertion>true</RemoveAssertion>
</ValidateSAMLAssertion>

Please help me to resolve this issue. If possible please share sample api.

[dchiesa1]

Where is the SAML Response with the assertion?  Have you examined it to verify that it is of the form you expect?  Can you show it here? Does it have the expected namespaces Is the XPath that you specified correct? 

Is the assertion encoded? Often SAML assertions provided by IDPs are compressed and then base64-encoded, and then embedded in an HTTP Header called SAMLResponse.  The ValidateSAMLAssertion policy is not able to handle that form of a SAML Assertion.  ValidateSAMLAssertion expects the SAML Assertion to be present in a plaintext XML document, not base64 encoded, and not compressed. If you need to decode the compressed-then-base64-encoded form of a SAML Assertion into plaintext XML, you can use this Java callout to do so.