InvalidSignature raised for SAML2 Response Assertions

[danieljimeneznz]

I have found a bug in the current version 2024.10.2 when the SAML2 signature is not correctly verified against the certificate stored in Authentik. I have found the issue to be with the below line, however I am unsure as to whether the NS_MAP would also need to change to support thesaml2p:Response. When a response comes in with a signature this automatically raises a InvalidSignature exception and causes the request to fail.

authentik/authentik/sources/saml/processors/response.py

Line 83 in def0a42

"/samlp:Response/saml:Assertion/ds:Signature", namespaces=NS_MAP

I have been using Google Workspace as the SAML IDP, which generates the following response:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://auth.com/source/saml/google-auth/acs/" ID="_9f8ea230f008ef523f6bb4069dd0487c" InResponseTo="_bca72c89d9b440d589e009a713528fd8" IssueInstant="2024-11-14T22:17:08.682Z" Version="2.0">
 <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://accounts.google.com/o/saml2?idpid=xxxx</saml2:Issuer>
 <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  <ds:SignedInfo>
   <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
   <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod>
   <ds:Reference URI="#_9f8ea230f008ef523f6bb4069dd0487c">
    <ds:Transforms>
     <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform>
     <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:Transform>
    </ds:Transforms>
    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod>
    <ds:DigestValue>NAPl1OID+yV0fu8Optx54yRJ9veTGOv9bUrYOteK9zE=</ds:DigestValue>
   </ds:Reference>
  </ds:SignedInfo>
  <ds:SignatureValue>ic/d8DOP8sxuv5Zg4gCfvhz2C2T9AMmmu8zl1DrPqZ3HxP65dX97wCkz5BOZT+S+YSSFz/lFO123
mRrq6rm5bqUDt2UcpWdnyIyTec6NSuUgoTkjioQhMb90QFiCocsEkqWj7l46+DzGNePVGo0iwpRE
rcH/3Mw7BOHWYXP+DLcJ1zkVH5stEJ5WU6Tr5uDio0xuQwcb73S45o2R7W2It1RY7Sys3cteWScI
TpY8hJyooBdxgxSYouxqjMsjB9UvHiQvBiD9ccqh/2G0fqm2MSIWPhobLKwvnZ1Ohpa4vqBwT5hg
WhIyu9T1IvswcQmckj03HtSVANNIQmPIjVlQOw==</ds:SignatureValue>
  <ds:KeyInfo>
   <ds:X509Data>
    <ds:X509SubjectName>ST=California,C=US,OU=Google For Work,CN=Google,L=Mountain View,O=Google Inc.</ds:X509SubjectName>
   ...
   </ds:X509Data>
  </ds:KeyInfo>
 </ds:Signature>
 <saml2p:Status>
  <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"></saml2p:StatusCode>
 </saml2p:Status>
 <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_a947162d5f95e377bb39afc2dc4f2813" IssueInstant="2024-11-14T22:17:08.682Z" Version="2.0">
 ...
 </saml2:Assertion>
</saml2p:Response>