[JIRA] (JENKINS-50749) SAMLException: No valid subject assertion found in response (Azure)

[email protected] (JIRA) Thu, 12 Apr 2018 03:07:24 -0700

Title: Message Title

Thank you so much, I was looking for this issue months, and now I have the SAMLResponse to figure out what happens. I'll plan to resolve those kinds of error by invalidating the session and redirecting to the login page again JENKINS-50004, for the moment the workaround is to enable "advanced/force auth"

I'll dig deeper into the response to see why is not valid

 
                                                                <samlp:Response
  ID="_65521826-71ff-42fc-93ba-9a9958370ba6"
  Version="2.0"
  IssueInstant="2018-04-11T18:48:42.429Z"
  Destination="https://jenkins.example.com/securityRealm/finishLogin"
  InResponseTo="_mcjoipte7kavyngvhqwbfzla9pp4kxb9b2s35v4"
  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://sts.windows.net/67b039ac-f578-42c6-9b5b-aa1b5bb0388f/</Issuer>
  <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
  <Assertion ID="_857608cf-646d-4ba0-9968-0e2a37b4b2f8" IssueInstant="2018-04-11T18:48:42.398Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
    <Issuer>https://sts.windows.net/67b039ac-f578-42c6-9b5b-aa1b5bb0388f/</Issuer>
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
      <SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
        <Reference URI="#_857608cf-646d-4ba0-9968-0e2a37b4b2f8">
          <Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
          <DigestValue>...</DigestValue>
        </Reference>
      </SignedInfo>
      <SignatureValue>...</SignatureValue>
      <KeyInfo>
        <X509Data>
          <X509Certificate>...</X509Certificate>
        </X509Data>
      </KeyInfo>
    </Signature>
    <Subject>
      <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">USER</NameID>
      <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData InResponseTo="_mcjoipte7kavyngvhqwbfzla9pp4kxb9b2s35v4" NotOnOrAfter="2018-04-11T18:53:42.398Z" Recipient="https://jenkins.example.com/securityRealm/finishLogin"/></SubjectConfirmation>
    </Subject>
    <Conditions NotBefore="2018-04-11T18:43:42.398Z" NotOnOrAfter="2018-04-11T19:43:42.398Z">
      <AudienceRestriction>
        <Audience>https://jenkins.example.com/securityRealm/finishLogin</Audience>
      </AudienceRestriction>
    </Conditions>
    <AttributeStatement>
      <Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid">
        <AttributeValue>67b039ac-f578-42c6-9b5b-aa1b5bb0388f</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier">
        <AttributeValue>83b0ac03-c7a4-46cc-90ac-143990d0a9eb</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.microsoft.com/identity/claims/displayname">
        <AttributeValue>Daniel Watrous</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider">
        <AttributeValue>https://sts.windows.net/67b039ac-f578-42c6-9b5b-aa1b5bb0388f/</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
        <AttributeValue>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AttributeValue>
        <AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname">
        <AttributeValue>Daniel</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname">
        <AttributeValue>Watrous</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
        <AttributeValue>[email protected]</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
        <AttributeValue>[email protected]</AttributeValue>
      </Attribute>
    </AttributeStatement>
    <AuthnStatement AuthnInstant="2018-03-28T17:41:00.065Z" SessionIndex="_857608cf-646d-4ba0-9968-0e2a37b4b2f8">
      <AuthnContext>
        <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef>
      </AuthnContext>
    </AuthnStatement>
  </Assertion>
</samlp:Response>
 
                                                            

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.

[JIRA] (JENKINS-50749) SAMLException: No valid subject assertion found in response (Azure)

Reply via email to