SAMLException: InResponseToField of the Response doesn't correspond to sent message

Question

We are working on an application, which is protected with spring security saml.

Authentication works fine, but there is one problem with the following workflow in production environment.

1. user requests the unprotected address www.server.com
2. response is a html page with an inline script that changes window.location.href to the saml protected page (service provider) www.server.com/app/action?param1=value1&param2=value2
3. spring saml detects that authentication is needed and redirects the user to the login form (identity provider) on www.login-server.com
4. at this point the login form is the first page that is displayed to the user
5. user adds this login page as bookmark (including saml related url params for this http session) www.login-server.com/adfs/ls/?SAMLRequest=xxx&SigAlg=xxx&Signature=arGdsZwJtHzTDjQP1oYqbjNO
6. user works with the application...
7. at the next day the user opens this bookmark and login
8. IdP redirects to the SP but the belonging http session has already expired

Now we get the following exception in our application:

org.opensaml.common.SAMLException: InResponseToField of the Response doesn't correspond to sent message arGdsZwJtHzTDjQP1oYqbjNO

Any ideas how to handle this workflow so the user can use the application after successful login? Thanks for your answers!

Izanami

Answer 1

We have solved our issue with following changes to the spring saml configuration:

1. In bean with id successRedirectHandler (org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler) we set the defaultTargetUrl to the init-Action of our application (including all request parameters). This url will be automatically used in case of IdP initiated SSO.
2. In Bean with id contextProvider (org.springframework.security.saml.context.SAMLContextProviderLB) we set storageFactory to org.springframework.security.saml.storage.EmptyStorageFactory. This disables the check of the InResponseToField.

Izanami

What is the init-Action of your application? – Smilacaceous

Our init action is something like /index.do?lang=de&paramX=Y. It is completly static, that's why our solution actually works. – Izanami

Why would you disable the check on InResponseToField, unless it is purely debugging in development? – Kerstin

EmptyStorageFactory is really helpful. Thank – Wisniewski

Answer 2

When you applicate generated an AuthnRequest, the request has an ID which your application somehow keeps. The corresponding response from IdP must have InResponseTo attribute set to that same ID value so that your application can verify that the response is meant to be for the request it sent.

However, when your user bookmarked the adfs link that contains request (www.login-server.com/adfs/ls/?SAMLRequest=xxx...), your application had totally forgotten about that request. In other word, it no longer kept the request ID somewhere and couldn't verify response.

The solution is to tell your users not to bookmark the www.login-server.com/adfs/ls/?SAMLRequest=xxx... link. Instead, they must bookmark a link in your application where it can generate a new request and send to ADFS.

Wesleywesleyan