Workaround for updated SAML not working against Entra ID about opencti

[mrrothe]

Just to add, this was working without issue in 6.1 without the additional SAML configuration

[SamuelHassine]

Hello,

Here is the working configuration in our cloud env:

              PROVIDERS__SAML__STRATEGY: "SamlStrategy"
              PROVIDERS__SAML__CONFIG__LABEL: "Corporate login"
              PROVIDERS__SAML__CONFIG__ISSUER: "opencti-filigran"
              PROVIDERS__SAML__CONFIG__ENTRY_POINT: "https://login.microsoftonline.com/[REDACTED]/saml2"
              PROVIDERS__SAML__CONFIG__SAML_CALLBACK_URL: "https://filigran.octi.filigran.io/auth/saml/callback"
              PROVIDERS__SAML__CONFIG__DISABLE_REQUESTED_AUTHN_CONTEXT: "true"
              PROVIDERS__SAML__CONFIG__CERT: "MIIC8DCCAdigAwIBAgIQfFMNtRPA5oxAfD5VLfjw9jANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQg[...]"
              PROVIDERS__SAML__CONFIG__ACCOUNT_ATTRIBUTE: "http://schemas.microsoft.com/identity/claims/displayname"
              PROVIDERS__SAML__CONFIG__FIRSTNAME_ATTRIBUTE: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
              PROVIDERS__SAML__CONFIG__LASTNAME_ATTRIBUTE: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"

[mrrothe]

I've tried adding the ACCOUNT/FIRSTNAME/LASTNAME ATTRIBUTE fields as per your config above - and tested with all combinations of WANT_AUTHN_RESPONSE_SIGNED and WANT_ASSERTIONS_SIGNED enabled/disabled.

Both -> "SAML assertion audience mismatch"
Just 'WANT_ASSERTIONS_SIGNED=false' -> "Invalid document signature"
Just 'WANT_AUTHN_RESPONSE_SIGNED=false' -> "SAML assertion audience mismatch"
Neither -> "Invalid document signature"

Not sure if there's anything different that needs to be configured on the Entra ID side - no errors/issues in the Entra ID logs and I can't see any configuration options for signing etc on that end.

Does adding a private key to the SAML config allow the response/assertion to be signed and remove the need for these additional parameters? If so is there any documentation for generating this private key?

[SamuelHassine]

@pierremahot @sbocahu did we changed anything in our instances for the Microsoft Entra SAML2 configuration following the library upgrade?