SAML Assertion not getting Signed from Azure to Oracle ERP Cloud

Viewed 25

We are exploring to use Azure B2C as IdP for Oracle Cloud ERP. We are using custom Policies to setup this communication channel using this.

For the XXXExtensions.xml file , below are the cryptographic keys that are being used.

      <CryptographicKeys>
        <Key Id="SamlMessageSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
        <Key Id="SamlAssertionSigning" StorageReferenceId="B2C_1A_SamlIdpCert"/>
      </CryptographicKeys>

and in the SignINSAML.xml file which extends XXXExtensions.xml and has relying Party information as below

<RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignInBasedOnGroupWithFgtPswd" />
    <TechnicalProfile Id="PolicyProfile">
      <DisplayName>PolicyProfile</DisplayName>
      <Protocol Name="SAML2" />
    <Metadata>
     <Item Key="WantsSignedAssertions">true</Item>
     <Item Key="WantsSignedRequests">true</Item>
     <Item Key="XmlSignatureAlgorithm">Sha256</Item>
    </Metadata>
      <OutputClaims>
        <OutputClaim ClaimTypeReferenceId="displayName" />
        <OutputClaim ClaimTypeReferenceId="givenName" />
        <OutputClaim ClaimTypeReferenceId="surname" />
        <OutputClaim ClaimTypeReferenceId="signInNames.emailAddress" PartnerClaimType="samlSubId" />
        <OutputClaim ClaimTypeReferenceId="email" DefaultValue="" />
        <OutputClaim ClaimTypeReferenceId="identityProvider" DefaultValue="" />
        <OutputClaim ClaimTypeReferenceId="objectId" />
      </OutputClaims>
      <SubjectNamingInfo ClaimType="samlSubId" ExcludeAsClaim="true" />
    </TechnicalProfile>
  </RelyingParty>

Now coming to the Oracle Part , Oracle expects the assertion to be signed and encrypted. I've not put in the encryption part yet as on the signing part itself we are getting error from Oracle that "Assertion is not signed" .

While testing SSO , we get through the User journeys as expected and SAML response gets posted to Oracle. However , the Signature tag in Assertion is missing as shown below.

  <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <saml:Assertion ID="_ffdbgrd2-7c94-4df2-8ee2f-95547e685f70" IssueInstant="2022-09-15T13:43:58.0923925Z" Version="2.0">
        <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://myB2CTenant.onmicrosoft.com/SamlApp1</saml:Issuer>
        <saml:Subject>
            <saml:NameID>XXX@gmail.com</saml:NameID>
            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData InResponseTo="id-meq56ZIj2Dvmg1Tyrf5V3X9F9rnHIBs315lt0YX4" NotOnOrAfter="2022-09-15T13:48:58.0923925Z" Recipient="https://oracle-tenant.fa.ocs.oraclecloud.com/oam/server/fed/sp/sso"/>
            </saml:SubjectConfirmation>
        </saml:Subject>

As you can see , there are no Signature tag in Assertion which is why oracle is giving the above error. Is there any other part of setup that needs to be considered in Azure ?

0 Answers
Related