http://coldfusion.com logo
Join Slack
Powered by
I'm working on an SSO integration with Duo using t...
# adobe
b
I'm working on an SSO integration with Duo using the built-in ColdFusion SAML functions. I am able to initiate the authentication procedure using 
initSAMLAuthRequest
, sign in with Duo, and then get kicked back to the desired ACS URL with a SAML response. However, when I get back to that URL and call 
processSAMLResponse
, ColdFusion is throwing an error saying that the URL I'm on is not expected. The URL bar shows me at "https://mysite.com/duo/acs", but ColdFusion is saying that it was expecting "http://mysite.com/index.cfm/duo/acs". The ACS URL I gave it in samlSettings was where I landed, but I'm unsure why there's a URL mismatch. My questions are: 1. Why is there a URL mismatch? Does this have anything to do with the samlSettings on the application? I didn't specify that I wanted requests signed in the service provider definition in samlSettings. 2. Is the /index.cfm part in the expected URL some artifact of the Apache connector? Currently we route requests so that everything not matching a file gets pushed to /index.cfm and then routed in CF.
Here's my IDP config:
Copy code
{
    name: "myapp",
    url: "[URL for Duo metadata]"
}
Here's my SP config:
Copy code
{
    name: "myapp_sp",
    entityID: "[URL for Duo metadata]",
    acsURL: "<https://mysite.com/duo/acs>",
    acsBinding: "POST",
    wantAssertionsSigned: true
}
b
Does the URL you have specified in CF Admin>Security>SP Configuration>[service provider configuration] match what you have here?
b
@Brian the config is in Application.cfc. I don't have anything in CF admin for IDP or SP settings.
b
My ACS URL paths have a specific page name. Maybe CF is inserting one since you aren't specifying one. Can you add that and see what happens? So like, https://mysite.com/duo/acs/index.cfm.
👍 1
b
I can try that. I also see the /index.cfm at the beginning of all of our FusionReactor information, so that's why I asked if this has anything to do with the Apache connector. I might be incorrectly relating unrelated evidence, but I found it noteworthy.
👍 1
h
Does your acsURL in the Coldfusion SP config match the ACS url in your federation metadata?
b
If it didn't, Duo would complain that it's not an allowed ACS URL and would stop the login process before it started.
h
true. I'd do what Brian suggested and update both so they include the page name as that's how we have ours configured too.
b
I updated the URL to have a file at 
/duo/acs/index.cfm
and that fixed part of my issue. CF is still expecting a call to http protocol however when I'm using https, so I'm not completely out of the woods yet.
Reporting back with an update to the protocol issue. I had to add a Valve entry to server.xml to allow the X-Forwarded-Proto header to pass through to Tomcat.
Still stuck on the issue of having 
index.cfm
that's being passed in from Apache when I don't have the file at 
/duo/acs/index.cfm
. Hopefully that can be overcome as well without needing to have the file there.
Open in Slack
PreviousNext
Powered by