Broken SAML SSO plugin with malformed URL when authenticating against Google IdP

[Luis-3M]

ISSUE TYPE

• Bug Report

COMPONENT NAME

SAML SSO plugin

CLOUDSTACK VERSION

LATEST -> https://github.com/apache/cloudstack/blame/main/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java#L153

CONFIGURATION

SAML SSO plugin activated.

OS / ENVIRONMENT

N/A

SUMMARY

Google's IdP URL already contains a query param, thus this line of code will create a malformed redirect URL.
https://github.com/apache/cloudstack/blame/main/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java#L153

Example of google's IdP URL: https://accounts.google.com/o/saml2/idp?idpid=XXXXXXXXX

STEPS TO REPRODUCE

• Enable and configure SAML SSO plugin2 using Google as the IdP.
• Access the UI and attempt to login via Single Sign-On

You should now face an Invalid Request error.

EXPECTED RESULTS

Users should be redirected to Google's login portal thus completing the authentication flow.

ACTUAL RESULTS

Malformed URL: 
https://accounts.google.com/o/saml2/idp?idpid=<ID>?SAMLRequest=<SAMLRequest>

Expected URL:
https://accounts.google.com/o/saml2/idp?idpid=<ID>&SAMLRequest=<SAMLRequest>

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[yadvr]

Can you share the IDP metadata @Luis-3M ?

[Luis-3M]

Hi @rohityadavcloud ,
Relevant fields of our IdP Metadata are the following:

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://accounts.google.com/o/saml2/idp?idpid=XXXXXXX"/>

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://accounts.google.com/o/saml2/idp?idpid=XXXXXXX"/>

Cloudstack SAML plugin assumes that the IdP URL will not have a query param which is not the case for Google.

[neogismm]

Hi @Luis-3M, can you share the google SAML error code?

[Luis-3M]

Hi @neogismm,
Apologies for the late response.

Successful request

Unsuccessful request (due to a broken redirect URL)

We should append the SAML request query param using "?" or "&" for cases where the IdP URL does not contain/does contain query params, respectively.

[yadvr]

Fixed in #6457