Sending blank username to PI from ADFS farm

[tedbear]

Hi Sbidy,

A couple of times we have experienced that a blank username, realm and transaction_id is sent to PI. I wonder if this happens on an ADFS farm if the connection is not persistent and therefore:

1. user signs in with UPN & PWD to ADFS being connected to ADFS server A
2. user posts his/her OTP code to ADFS server B

Is there a way (or maybe this is already happening) to capture the actual username also when submitting the OTP, or does this only happen on the step before reaching the OTP screen?

This probably happened 4 times during 50 logins. We are still testing with just around 15 people. We will however roll out to 18.000 users shortly (hopefully).

Best regards,
Teddy

[tedbear]

Thinking of it, I don't believe the realm is stored in the session, is it? So the lost session does not explain the blank realm sent.

[cornelinux]

To my understanding the username is passed as hidden field to the login form?
https://github.com/sbidy/privacyIDEA-ADFSProvider/blob/master/privacyIDEAADFSProvider/AdapterPresentationForm.cs#L50
So the username should be available.
Could it be, that someone manages to enter an empty username in the first place?

[tedbear]

Not really possible, as they wouldn't then be authenticated (in order to get to the OTP step).
The username canbe in two formats: userprincipalname (in our case our email address) or domain\samaccountname

[cornelinux]

So the username should be a hidden field in the login dialog. Did you check the source code of the otp login html page, if the username is actually contained? So that you can narrow down, where the username gets lost?

[tedbear]

The issue is that I cannot reproduce is, although it has been reported 4 times by my colleagues who are testing. I did verify that they entered the correct code (it is logged on our BIG-IP proxy):
Normal OTP login:

Missing username, realm and trans:

I believe it happens on those webview popups (Outlook, Skype and OneDrive - the thick clients) in which you cannot see the source code. Although not consistently, as they work 9/10 times.
Doing normal tests I do see the username as a hidden field, yes.

[tedbear]

In addition I have also tested every ADFS directly to filter out any faulty farm members - all of them works/have the correct code in place.

[cornelinux]

Maybe you can also log the User-Agent in the Big IP, so you can be sure, if this problem only occurs on certain clients.

[tedbear]

Unfortunately I have no proxy in front of those ADFS's (thats a long story about two separate companies sharing a 365 environment). Only in front of the PI server.

[cornelinux]

Can the big IP only log parameters? Can't you log header information of the http request?

[tedbear]

I can, but the requests to the PI is the adfs plug-in doing that, not the client :) On 28 Dec 2018, at 11:06, Cornelius Kölbel <notifications@github.com<mailto:notifications@github.com>> wrote: CAUTION: This email originated from outside the organization. Do not click on a link or open an attachment unless you recognize the sender and know the content is safe. Can the big IP only log parameters? Can't you log header information of the http request? — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#17 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AFxgSQ2m4O4MXQoRltQoc91ctgISm9pcks5u9e0ggaJpZM4ZjmwQ>.

[cornelinux]

Oh. You are right. My bad! I should have studied this system better ;-)

[sbidy]

Hey! So I try to recap the issue: In some (use)cases the username and realm field in the OTP-Auth.-Webview is empty. This behavior can not be reproduced but mostly shows up on/requests from Office client software.

In my opinion the issue occurs if the username and the "realm" are not a part of the SAML-Token/Claim.

privacyIDEA-ADFSProvider/privacyIDEAADFSProvider/Adapter.cs

Line 51 in b58a01f

string[] tmp = identityClaim.Value.Split('\\');

In this case the username and realm(domain) is empty and this leads to such a behavior.
Please check the EventLog for errors and exceptions. In this case a event (exception) should be logged.

For debugging and testing I'll prepare a "debug" version for you, so I can get a better understanding why and where the error occurs.
Additionally I'll check the interface definition from MS what exactly the identityClaim represents.

[sbidy]

Here is the debug version: Download
Please use only for testing. To get/read the debug messages please use the DebugView from the Sysinternals tool set --> DebugView v4.81. The debug message prefixes are ID3A_ADFSadapter: and ID3Aprovider:.