Loading

How to Extract SAML Assertion XML From HAR File

Publiseringsdato: Nov 19, 2024
Oppgave

GOAL

To troubleshoot SAML based Single-Sign-On(SSO) to the Anypoint Platform, we often need to extract the SSO SAML assertion details from the request. This article gives the steps on how to do so from the HAR file captured when SSO to the Anypoint Platform.
Trinn

Please read the HAR Security Guideline before creating them in the below-supported browsers

HAR (http archive) files may contain sensitive data, including cookies, authentication tokens, and personal information. This data can lead to security risks such as impersonation and unauthorized access. 

When creating a HAR File customers must ensure that the following safeguards are completed, before the file is sent to Salesforce Support and Third Party Vendors.

  1. Sanitize: Sanitize files before sharing using a HAR sanitize ( Example -Cloudflare HAR sanitizer) or manually with a text editor, to redact sensitive information.
  2. Log Out of Sessions: If investigating non-authentication issues, log out of any active sessions before recording to enhance security and prevent capturing active session tokens.
  3. HAR Hygiene: Treat HAR files as Restricted. Restrict access to only appropriate personnel and ensure secure storage and transmission. HAR Files must never be uploaded un-sanitized outside of Salesforce (e.g. chatGPT)

 

Step 1, following the knowledge article "How to retrieve HTTP archive files (HAR)" when the SSO to the Anypoint Platform is performed.

Step 2, once the HAR file is captured, please find the request to https://anypoint.mulesoft.com/accounts/login/receive-id and locate the value of the parameter "SAMLResponse", which is a long string.

for example:
 

"request": {
          "method": "POST",
          "url": "https://anypoint.mulesoft.com/accounts/login/receive-id",
          "httpVersion": "HTTP/1.1",
          ...
          "postData": {
            "mimeType": "application/x-www-form-urlencoded",
            "text": "SAMLResponse=PD94b...&RelayState=",
            "params": [
              {
                "name": "SAMLResponse",
                "value": "PD94b..."
              },
              {
                "name": "RelayState",
                "value": ""
              }
            ]
          }
        },


Step 3, copy the long string and URL decode it.


You could use https://www.urldecoder.org/ to decode it.


Step 4, copy the URL decoded string and base64 decode it.


You could use https://www.base64decode.org/ to decode it.

The output is the SAML Assertion XML in human-readable format, like: 
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="https://anypoint.mulesoft.com/accounts/login/receive-id" ID="id102899906075521711077394618" IssueInstant="2020-10-06T00:49:08.454Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xs="http://www.w3.org/2001/XMLSchema">
	<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/xxxxxxxxxxxxxxxxxxxxx</saml2:Issuer>
	<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
		<ds:SignedInfo>
			<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
			<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
			<ds:Reference URI="#id102899906075521711077394618">
				<ds:Transforms>
					<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
					<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
						<ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
					</ds:Transform>
				</ds:Transforms>
				<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
				<ds:DigestValue>...</ds:DigestValue>
			</ds:Reference>
		</ds:SignedInfo>
		<ds:SignatureValue>...</ds:SignatureValue>
		<ds:KeyInfo>
			<ds:X509Data>
				<ds:X509Certificate>...</ds:X509Certificate>
			</ds:X509Data>
		</ds:KeyInfo>
	</ds:Signature>
	<saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
		<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
	</saml2p:Status>
	<saml2:Assertion ID="id102899906076315621983006756" IssueInstant="2020-10-06T00:49:08.454Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema">
		<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/xxxxxxxxxxxxxxxxxxxxx</saml2:Issuer>
		<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
			<ds:SignedInfo>
				<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
				<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
				<ds:Reference URI="#id102899906076315621983006756">
					<ds:Transforms>
						<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
						<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
							<ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
						</ds:Transform>
					</ds:Transforms>
					<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
					<ds:DigestValue>...</ds:DigestValue>
				</ds:Reference>
			</ds:SignedInfo>
			<ds:SignatureValue>...</ds:SignatureValue>
			<ds:KeyInfo>
				<ds:X509Data>
					<ds:X509Certificate>...</ds:X509Certificate>
				</ds:X509Data>
			</ds:KeyInfo>
		</ds:Signature>
		<saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
			<saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">sean.li@mulesoft.com</saml2:NameID>
			<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
				<saml2:SubjectConfirmationData NotOnOrAfter="2020-10-06T00:54:08.454Z" Recipient="https://anypoint.mulesoft.com/accounts/login/receive-id"/>
			</saml2:SubjectConfirmation>
		</saml2:Subject>
		<saml2:Conditions NotBefore="2020-10-06T00:44:08.454Z" NotOnOrAfter="2020-10-06T00:54:08.454Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
			<saml2:AudienceRestriction>
				<saml2:Audience>anypoint.mulesoft.com</saml2:Audience>
			</saml2:AudienceRestriction>
		</saml2:Conditions>
		<saml2:AuthnStatement AuthnInstant="2020-10-06T00:49:08.454Z" SessionIndex="id1601945348452.291824165" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
			<saml2:AuthnContext>
				<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
			</saml2:AuthnContext>
		</saml2:AuthnStatement>
		<saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
			<saml2:Attribute Name="firstname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
				<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Sean</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="lastname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
				<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Li</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
				<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">sean.li@mulesoft.com</saml2:AttributeValue>
			</saml2:Attribute>
			<saml2:Attribute Name="group" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
				<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">...</saml2:AttributeValue>
				<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">...</saml2:AttributeValue>
			</saml2:Attribute>
		</saml2:AttributeStatement>
	</saml2:Assertion>
</saml2p:Response>



 

 

Knowledge-artikkelnummer

001115955

 
Laster
Salesforce Help | Article