OneLogin SAML Instructions

[fstuck37]

Hello All,
Does anyone have instructions on how to setup OneLogin authentication?
I've made what I think are the correct changes to the config.py file, however, the site does not prompt for SSO credentials and local authentication still works.

What I did notice in the config.py file is "{BASE}api/1/auth/onelogin?acs" which when I try to access that URL I receive 404 error. So wondering if I'm missing something in my deployment.

Searched around a bunch but the only reference I've found is to the config file.

Any help would be appreciated.

Thanks,
Fred

[fstuck37]

OK doing a little more poking around and realized I need https://github.com/onelogin/python-saml
And got to the point of successfully doing the "pip install python-saml"

What I'm not clear on is this section:
Copy the core of the library (src/onelogin/saml2 folder) and merge the setup.py inside the python application. (each application has its structure so take your time to locate the Python SAML toolkit in the best place).

Any help would be appreciated.
Thanks,
Fred

[scriptsrc]

Hey @fstuck37 - The python-saml is an optional dependency we define in setup.py

security_monkey/setup.py

Line 70 in 93092a6

'onelogin': ['python-saml>=2.2.0'],

However, your pip install should also work just fine. The python-saml module requires a couple dependencies that must be installed with something like apt-get

sudo apt-get install libxml2-dev
sudo apt-get install libxmlsec1-dev

I don't believe these instructions are necessary:

Copy the core of the library (src/onelogin/saml2 folder) and merge the setup.py inside the python application. (each application has its structure so take your time to locate the Python SAML toolkit in the best place).

Make sure your config has the ACTIVE_PROVIDERS set:

ACTIVE_PROVIDERS = ['onelogin']

If you're still having trouble, see if the onelogin_import_success bool is set to True in this file:

security_monkey/security_monkey/sso/views.py

Line 361 in 813a0c6

api.add_resource(OneLogin, '/auth/onelogin', endpoint='onelogin')

Maybe change this:

if onelogin_import_success:
    api.add_resource(OneLogin, '/auth/onelogin', endpoint='onelogin')

to this:

if onelogin_import_success:
    api.add_resource(OneLogin, '/auth/onelogin', endpoint='onelogin')
    current_app.logger.debug('onelogin should be good to go')
else:
    current_app.logger.debug('onelogin import failure')

And check the logs to see if onelogin imported correctly.

[fstuck37]

Thanks for the info I think I'm getting further however it's still not working.
So I get this error:

 File "/usr/local/src/security_monkey/venv/lib/python2.7/site-packages/Flask_RESTful-0.3.3-py2.7.egg/flask_restful/__init__.py", line 473, in url_for
    endpoint = resource.endpoint

which tracing that down points to the file you suggested since it won't set the endpoint if the import isn't successful.

So I guess I'm back to, I know I'm missing an install step for OneLogin to get that working.

I'm thinking I need to do a python setup.py for OneLogin with some parameters but really not clear what's needed to tie it in with Security Monkey.

Any suggestions would be appreciated.

Thanks again,
Fred

P.S. My thanks to the entire Security Monkey team for releasing this great tool!

[scriptsrc]

1. Did you run the apt-get install commands I pasted?
2. Were you in your virtualenv when you ran the pip install ?
3. When in your virtualenv, can you run a pip freeze and make sure both python-saml and security_monkey show up?

This is how you might tell setup.py to install the extras, but it literally does the same thing as your pip install.

python setup.py develop
pip install .[onelogin]

Here's the code that actually imports the library:

security_monkey/security_monkey/sso/views.py

Line 18 in 813a0c6

try:

try:
    from onelogin.saml2.auth import OneLogin_Saml2_Auth
    from onelogin.saml2.utils import OneLogin_Saml2_Utils
    onelogin_import_success = True
except ImportError:
    onelogin_import_success = False

so maybe open python up interactively and try to import the onelogin stuff:

 $ python
Python 2.7.12 (default, Nov 19 2016, 06:48:10)
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from onelogin.saml2.auth import OneLogin_Saml2_Auth
>>> from onelogin.saml2.utils import OneLogin_Saml2_Utils

[fstuck37]

OK That helped and lead me to a segmentation fault with the import.
This was part of the fix:
4teamwork/ftw.saml2auth#3
--- /usr/bin/xmlsec1-config.orig
+++ /usr/bin/xmlsec1-config
-the_flags="$the_flags -D__XMLSEC_FUNCTION__=FUNCTION -DXMLSEC_NO_GOST=1 -DXMLSEC_NO_XKMS=1 -DXMLSEC_DL_LIBLTDL=1 -I/usr/include/xmlsec1 $the_xml_flags $the_xslt_flags $the_crypto_flags"
+the_flags="$the_flags -D__XMLSEC_FUNCTION__=FUNCTION -DXMLSEC_NO_GOST=1 -DXMLSEC_NO_XKMS=1 -DXMLSEC_DL_LIBLTDL=1 -DXMLSEC_NO_SIZE_T -I/usr/include/xmlsec1 $the_xml_flags $the_xslt_flags $the_crypto_flags"

So I kept poking around and found this:
SAML-Toolkits/python-saml#30
And found this in the thread and stopped getting the seg fault during the import.
pip uninstall dm.xmlsec.binding
pip install dm.xmlsec.binding

Still looking to see if there is a cleaner fix, however, this did the job.
I'm now seeing the OneLogin button when I go to the login page!!!!

I'll confirm that it works tomorrow as I have to have the OneLogin team make a change.

Thanks for all the help!
Fred

[fstuck37]

Success!
Had to make some OneLogin and config.py changes but with the above, I was able to get OneLogin working with Security Monkey.

Thanks again to the Security Monkey team for releasing this publicly.
What a great tool!!

Thanks,
Fred

[cplvic]

@MonkeySecurity - I was going to write a doc on how to do various things like setting up OneLogin etc.
Would it be a Pull Request or some other method

[EmptyLaughter]

@fstuck37 Can you elaborate on what changes you made to config.py and on the OneLogin side?
I've faced the previous issues that you've encountered, but now I'm getting authentication errors. I have a SAML Test Connector (IdP w/attr) set up, so I can access the app via the OneLogin portal, but the IdP isn't sending the correct response to the SP.

Error from log file:
ERROR: Error processing invalid_response
Error message from webpage:
{"message": "OneLogin authentication failed."}

[fstuck37]

@EmptyLaughter Unfortunately I had it working in our development environment and got side tracked with the deployment. When I returned and tried to deploy to production it no longer worked.

I need to find time to get it working again but here is what I was doing:

ONELOGIN_APP_ID = OneLogin Application ID
ONELOGIN_X509CERT = OneLogin Certificate

sed -i "s/<APP_ID>/${ONELOGIN_APP_ID}/" /usr/local/src/security_monkey/env-config/config.py
sed -i "s#<ONELOGIN_APP_CERT>#${ONELOGIN_X509CERT}#" /usr/local/src/security_monkey/env-config/config.py

sed -i "s/User.email/User.email/" /usr/local/src/security_monkey/env-config/config.py
sed -i "s/'View'/'View'/" /usr/local/src/security_monkey/env-config/config.py

Thanks,
Fred