Univention Bugzilla – Bug 49485
Make subnet filtering configurable for Kerberos-Auth in SAML-IdP
Last modified: 2023-08-22 21:53:57 CEST
Make subnet filtering configurable for Kerberos-Auth in SAML-IdP in the /etc/simplesamlphp/authsources.php See: https://github.com/simplesamlphp/simplesamlphp/blob/simplesamlphp-1.14/modules/negotiate/docs/negotiate.txt#L149
The effort to add this is low, just add a UCRv that configures a line in /etc/univention/templates/files/etc/simplesamlphp/01authsources-negotiate.php 'subnet' => array('127.0.0.0/16','192.168.0.0/16'),
Customer asked for it because it would be workaround for Bug #47242 and blocks the further rollout of schools.
Patch in branch git:fbest/49485-saml-negotiate-filter-subnets. +[saml/idp/negotiate/filter-subnets] +Description[de]=Beschränkt die Anmeldung per Kerberos / HTTP Negotiate auf Anfragen aus dem angegebenen Subnetz. Der Wert ist eine kommaseparierte Liste von Netzwerken (z.B.: 127.0.0.0/16,192.168.0.0/16). +Description[en]=Restrict single sign on via Kerberos / HTTP negotiate only to clients requesting from the specified subnet. The value is a comma spearated list of networks (example: 127.0.0.0/16,192.168.0.0/16). +Type=str +Categories=saml
univention-saml (6.0.2-9) 0d3489f1a3f4 | Bug #49485: allow to restrict negotiate authentication to certain IP networks univention-saml.yaml 0d3489f1a3f4 | Bug #49485: allow to restrict negotiate authentication to certain IP networks
The package didn't declare a build dependency to python-support and therefore the UDM handler was not correctly installed. This let all tests fail / not being executed: 23:49:25 [master091] . utils.sh; assert_join 23:49:56 23:49:56 stdout: Warning: 'univention-saml' is not configured. 23:49:56 Warning: 'univention-management-console-web-server' is not configured. 23:49:56 Error: Not all install files configured: 2 missing 23:49:56 Warning: 'univention-saml' is not configured. 23:49:56 Warning: 'univention-management-console-web-server' is not configured. 23:49:56 Error: Not all install files configured: 2 missing 23:49:56 Warning: 'univention-saml' is not configured. 23:49:56 Warning: 'univention-management-console-web-server' is not configured. 23:49:56 Error: Not all install files configured: 2 missing join.log: Object created: cn=serviceprovider,cn=custom attributes,cn=univention,dc=AutoTest091,dc=local unknown module saml/serviceprovider. Available Modules are: … __JOINERR__:FAILED: /usr/lib/univention-install/91univention-saml.inst Fixed in: univention-saml (6.0.2-12) 4b48e227b564 | Bug #49485: add missing build dependency to python-support
UCR-Variable sets /etc/simplesamlphp/authsources.php : OK UCR-Variable description: OK Only UCS Clients in set subnet can use Kerberos-Auth in Saml OK Only Windows Clients "" : OK Yaml: OK missing built dependecy added:OK Verified
<http://errata.software-univention.de/ucs/4.4/358.html>