How to retrieve SAML2 token in PHP for getting an OAuth token from WSO2 APIM

Question

I have been looking around for a solution but can't find it.

This question is directly related to:

Here's the scenario I want to execute:

authenticate to the SP using SAML2. Coded in PHP with SimpleSamlPhp.
get an OAuth token from the API mgr endpoint, using the SAML2 assertion. (using URL http://api.gateway/token)
call APIs over the API mgr's gateway, using the OAuth token.

I'm stuck at the instruction: get the SAML2 assertion token. Where do I find this token? In SimpleSamlPhp I can get attributes of the user, or their id, but I can't find any assertion.

I hacked SSP to get the last assertion, but don't know what to do with it. I was expecting a single value (like a token), but it's a complex structure. And one of the links above says I shouldn't be accessing it!

What do I send, encoded, to the token URL?

EDIT: adding some samples. My assert XML (edited):



   https://g...p.com:9443/samlsso
   
      
         
         
         
            
               
               
            
            
            RrGcR...cktFuH0=
         
      
      b91j/k...Z7d4=
      
         
            MIICNT...Wq8uHSCo=
         
      
   
   
      toto@titi.com
      
         
      
      
         
      
   
   
      
         mytestapp
         https://my.wso2.apim:8243/token
      
   
   
      
         urn:oasis:names:tc:SAML:2.0:ac:classes:Password

encode as base64-URL-encoded XML:

PHNhbWwyO...dGlvbj4,

using the method copied from another SO post

function base64_url_encode($input) {
 return strtr(base64_encode($input), '+/=', '-_,');
}

It's about 20 lines long (and yes, there's a comma at the end).

It doesn't work, I get the JSON result

{"error":"invalid_grant","error_description":"Provided Authorization Grant is invalid."}

In the traces:

TID: [0] [AM] [2016-11-29 11:04:50,297] DEBUG {org.wso2.carbon.identity.oauth2.token.handlers.grant.saml.SAML2BearerGrantHandler} -  SAML Token Issuer verification failed or Issuer not registered {org.wso2.carbon.identity.oauth2.token.handlers.grant.saml.SAML2BearerGrantHandler}
TID: [0] [AM] [2016-11-29 11:04:50,298] DEBUG {org.wso2.carbon.identity.oauth2.token.AccessTokenIssuer} -  Invalid Grant provided by the client, id=fkJa...Ohoa, user-name=null to application=myapp-subscriber_test_PRODUCTION {org.wso2.carbon.identity.oauth2.token.AccessTokenIssuer}
TID: [0] [AM] [2016-11-29 11:04:50,300] DEBUG {org.wso2.carbon.identity.oauth2.token.AccessTokenIssuer} -  OAuth-Error-Code=invalid_grant client-id=fkJa...hoa grant-type=urn:ietf:params:oauth:grant-type:saml2-bearer scope=PRODUCTION {org.wso2.carbon.identity.oauth2.token.AccessTokenIssuer}

I'm asking around to the configurators of the system. Seems to me there's something missing in the link between IDS, APIM and OAuth, some declaration. (I googled this, and came up with a stackoverflow exchange to check the issuer id in the assertion, which I did, but I can't identify anything wrong there)

Thanks for the help, I will come back if I have anything new. Except of course if I have overlooked something obvious!

JRobinss · Accepted Answer

I have succeeded, so here are some indications for others who may have the same issue.

I hacked simpleSamlPhp because they do not provide the SAML2 assertion (see https://github.com/simplesamlphp/simplesamlphp/issues/220). I did not do it in a nice way, because I only wanted to make it work. It's ugly but it works. Here's my hack, I put it at line 125 of saml2-acs.php:
```
// ADDED to get SAML2 assertion in SP
if (array_key_exists('SAMLResponse', $_POST)) {
    $attributes["samlresp"] = $_POST['SAMLResponse'];
}
```

In my PHP app, I then use this code:

$authdata_array= $as->getAuthDataArray();
$postSaml2Assert = $authdata_array["Attributes"]["samlresp"];
$msg = base64_decode($postSaml2Assert);
$document = new DOMDocument();
$document->loadXML($msg);
$assertion = $document->getElementsByTagNameNS ("urn:oasis:names:tc:SAML:2.0:assertion", "Assertion")->item(0);
$saml2AssertionXml = $document->saveXML($assertion);

Hope this helps others. Thanks @Bhathiya for helping!

How to retrieve SAML2 token in PHP for getting an OAuth token from WSO2 APIM

Answers (2)

Related Questions