Amazon Grafanaへのシングルサインオンのため、簡易な試験環境として、Lambda（関数URL）でSAML 2.0 Identity Provider (IdP) を作成してみました

			
			% git clone https://github.com/furuya02/lambda-saml-idp.git
% cd lambda-saml-idp

		

			
			% mkdir cert && cd cert

// Generate private key
% openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048

// Generate certificate signing request（質問項目は、すべてEnterキーで進んでも大丈夫です）
% openssl req -new -key private.key -out server.csr

// Generate self-signed certificate (valid for 1 year)
% openssl req -x509 -days 365 -key private.key -in server.csr -out public.crt

// Clean up CSR file
% rm server.csr

// Verify files created
% ls -la
 -rw-r--r--  public.crt   (certificate)
 -rw-------  private.key  (private key)

% cd ..

		

			
			% cd cdk

// Install dependencies
% npm install

// Build TypeScript
% npm run build

// Preview changes (optional)
% npx cdk diff

// Deploy the stack
% npx cdk deploy

		

			
			{
  "context": {
    "app": {
      "projectName": "lambda-saml-idp",
      "endpoint": "https://xxxxx.lambda-url.ap-northeast-1.on.aws/",
      "entityId": "urn:example:idp",
      "publicCrt": "lambda-saml-idp-public-crt",
      "privateKey": "lambda-saml-idp-private-key"
    },
    "@aws-cdk/aws-lambda:recognizeLayerVersion": true
  }
}

		

			
			import { CONFIG, USER_ACCOUNT } from "./types";

export const config: CONFIG = {
  issuer: "urn:example:idp",
  endpoint: "http://localhost:8888",
  acsUrl:
    "https://g-xxxxxx0881.grafana-workspace.ap-northeast-1.amazonaws.com/saml/acs",
};

		

			
			% npm run build
% npx cdk diff
% npx cdk deploy

		

			
			export async function createSamlMetadata(
  endpoint: string,
  entityId: string
): Promise<string> {
  const publicCrt = await getSecret("PUBLIC_CRT");
  const X509Certificate = publicCrt
    .replace(/-----BEGIN CERTIFICATE-----/, "")
    .replace(/-----END CERTIFICATE-----/, "")
    .replace(/\n/g, "");

  return `<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor entityID="${entityId}">
  <md:IDPSSODescriptor>
    <md:KeyDescriptor use="signing">
      <ds:X509Certificate>${X509Certificate}</ds:X509Certificate>
    </md:KeyDescriptor>
    <md:SingleSignOnService Location="${endpoint}sso"/>
  </md:IDPSSODescriptor>
</md:EntityDescriptor>`;
}

		

			
			 } else if (method === "GET" && path.startsWith("/sso")) {
    return {
      statusCode: 302,
      headers: {
        Location: `/login?${event.rawQueryString}`,
      },
      body: "",
    };

		

			
			} else if (method === "GET" && path.startsWith("/login")) {
    // Loginフォームの表示
    const loginForm = createLoginForm(event.rawQueryString, "");

    return {
      statusCode: 200,
      headers: {
        "Content-Type": "text/html; charset=utf-8",
      },
      body: loginForm,
    };

		

			
			  } else if (method === "POST" && path.startsWith("/login")) {
    const body = Buffer.from(event.body!, "base64").toString("utf-8");
    if (!authenticateUser(body)) {
      const loginForm = createLoginForm(
        event.rawQueryString,
        "ユーザー名若しくは、パスワードが無効です"
      );
      // 認証に失敗した場合、Loginフォームを再表示
      return {
        statusCode: 200,
        headers: {
          "Content-Type": "text/html; charset=utf-8",
        },
        body: loginForm,
      };
    }

		

			
			    // 認証に成功した場合の処理をここに追加
    const samlRequest = event.queryStringParameters?.SAMLRequest || "";
    const relayState = event.queryStringParameters?.RelayState || "";
    const saml = samlRequestParse(samlRequest);


		

			
			export function samlRequestParse(base64str: string): string {
  // URLデコード
  const decodedUrl = decodeURIComponent(base64str);

  // base64デコード
  const decodedBytes = Buffer.from(decodedUrl, "base64");

  // zlibで解凍（raw deflateとzlib両方を試す）
  let decompressedData;
  try {
    // 通常のzlib形式を試す
    decompressedData = zlib.inflateSync(decodedBytes);
  } catch (error) {
    // raw deflate形式を試す
    decompressedData = zlib.inflateRawSync(decodedBytes);
  }

  const requestSaml = decompressedData.toString();

  return requestSaml;
}


		

			
			export interface AUTHN_REQUEST {
  id?: string;
  version?: string; 
  issueInstant?: string;
  destination?: string;
  assertionConsumerServiceURL?: string;
  issuer?: string;
  nameIdFormat?: string;
}

		

			
			    const authnRequest = parseSamlAuthnRequest(saml);
    // cinfig.acsUrlが（空白ではない場合）設定されている場合、SPのリクエストからACSと比較するし、不一致の場合は受け付けない
    if (
      config.acsUrl !== "" &&
      config.acsUrl !== authnRequest.assertionConsumerServiceURL
    ) {
      return {
        statusCode: 404,
        headers: {
          "Content-Type": "text/html; charset=utf-8",
        },
        body: "Invalid ACS URL",
      };
    }


		

			
			// SAMLResponseを生成する
const samlResponse = createSAMLResponse(config.issuer, authnRequest);

		

			
			export function createSAMLResponse(
  entityId: string,
  authnRequest: AUTHN_REQUEST
): string {
  const timestampProvider = new SamlTimestampProvider();

  const id = uuidv4(); //Responseで生成
  const assertionId = uuidv4(); //Responseで生成
  const XMLS_SCHEMA = "http://www.w3.org/2001/XMLSchema";

  const inResponseTo = authnRequest.id; // Request のIDを指定
  const acsUrl = authnRequest.assertionConsumerServiceURL;
  const metadataUrl = authnRequest.issuer;

  let samlResponse = `
    <?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response xmlns:saml2p="${SAML_NAMESPACE_2_0}:protocol" xmlns:saml2="${SAML_NAMESPACE_2_0}:assertion" ID="${id}" Version="2.0" IssueInstant="${timestampProvider.getIssuedAt()}" Destination="${acsUrl}" InResponseTo="${inResponseTo}">
  <saml2:Issuer>${entityId}</saml2:Issuer>
  <saml2p:Status>
    <saml2p:StatusCode Value="${SAML_NAMESPACE_2_0}:status:Success"/>
  </saml2p:Status>
  <saml2:Assertion xmlns:saml2="${SAML_NAMESPACE_2_0}:assertion" ID="${assertionId}" Version="2.0" IssueInstant="${timestampProvider.getIssuedAt()}">
    <saml2:Issuer>${entityId}</saml2:Issuer>
    <saml2:Subject>
      <saml2:NameID Format="${SAML_NAMESPACE_2_0}:nameid-format:emailAddress">admin@example.com</saml2:NameID>
      <saml2:SubjectConfirmation Method="${SAML_NAMESPACE_2_0}:cm:bearer">
        <saml2:SubjectConfirmationData NotOnOrAfter="${timestampProvider.getNotOnOrAfter()}" Recipient="${acsUrl}" InResponseTo="${inResponseTo}"/>
      </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="${timestampProvider.getIssuedAt()}" NotOnOrAfter="${timestampProvider.getNotOnOrAfter()}">
      <saml2:AudienceRestriction>
        <saml2:Audience>${metadataUrl}</saml2:Audience>
      </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="${timestampProvider.getIssuedAt()}" SessionNotOnOrAfter="${timestampProvider.getSessionExpiry()}">
      <saml2:AuthnContext>
        <saml2:AuthnContextClassRef>${SAML_NAMESPACE_2_0}:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
      </saml2:AuthnContext>
    </saml2:AuthnStatement>
    <saml2:AttributeStatement>
      </saml2:Attribute>`;

  userAccountList.forEach((account) => {
    Object.entries(account).forEach(([key, value]) => {
      if (key === "user" || key === "password") return; // ユーザ名・パスワードは含めない
      samlResponse += `
      <saml2:Attribute Name="${key}" NameFormat="${SAML_NAMESPACE_2_0}:uri">
        <saml2:AttributeValue xsi:type="xs:string" xmlns:xsi="${XMLS_SCHEMA}-instance" xmlns:xs="${XMLS_SCHEMA}">${value}</saml2:AttributeValue>
      </saml2:Attribute>
      `;
    });
  });
  samlResponse += `</saml2:AttributeStatement>
  </saml2:Assertion>
</saml2p:Response>`;
  // Remove whitespace and newlines for compact XML
  return samlResponse.replace(/\s+/g, " ").replace(/>\s+</g, "><").trim();
}

		

			
			//署名する
const signedXml = await signXML(samlResponse);

		

			
			export async function signXML(xml: string): Promise<string> {
  const privateKey = await getSecret("PRIVATE_KEY");
  const publicCert = await getSecret("PUBLIC_CRT");
  if (!privateKey || !publicCert) {
    throw new Error("Failed to retrieve keys");
  }
  const sig = new SignedXml();

  // Response全体に署名を適用
  sig.addReference(
    "//*[local-name()='Response']",
    [
      "http://www.w3.org/2000/09/xmldsig#enveloped-signature",
      "http://www.w3.org/2001/10/xml-exc-c14n#",
    ],
    "http://www.w3.org/2001/04/xmlenc#sha256"
  );

  sig.signingKey = privateKey;
  sig.keyInfoProvider = {
    getKeyInfo: () => {
      const certFormatted = publicCert
        .replace(/-----BEGIN CERTIFICATE-----/, "")
        .replace(/-----END CERTIFICATE-----/, "")
        .replace(/\n/g, "");
      return `<X509Data><X509Certificate>${certFormatted}</X509Certificate></X509Data>`;
    },
    getKey: () => Buffer.from(privateKey),
  };

  sig.computeSignature(xml, {
    location: {
      reference: "//*[local-name()='Issuer']",
      action: "after",
    },
  });

  return sig.getSignedXml();
}

		

			
			const encodedResponse = Buffer.from(signedXml).toString("base64");
    const html = `
          <html>
            <head><title>Keep Calm and Single Sign-On!</title></head>
            <body>
              <form method="post" name="hiddenform" action="${config.acsUrl}">
                <input type="hidden" name="SAMLResponse" value="${encodedResponse}">
                ${
                  relayState
                    ? `<input type="hidden" name="RelayState" value="${relayState}">`
                    : ""
                }
                <noscript>
                  <p>JavaScript is disabled. Click Submit to continue.</p>
                  <input type="submit" value="Submit">
                </noscript>
              </form>
              <script language="javascript" type="text/javascript">
                window.setTimeout(function(){document.forms[0].submit();}, 0);
              </script>
            </body>
          </html>
        `;
    return {
      statusCode: 200,
      headers: {
        "Content-Type": "text/html; charset=utf-8",
      },
      body: html,
    };

		

			
			  1. 認証情報の管理
    - パスワードが平文でハードコード（cdk/lambda/const.ts）
    - ブルートフォース攻撃対策なし
    - セッション管理の欠如
  2. SAML セキュリティ
    - 受信SAMLリクエストの署名検証なし
    - リプレイアタック対策不足（ID再利用チェック、タイムスタンプ検証なし）
    - InResponseTo検証が不完全
  3. 入力検証
    - XSS対策不足（ログインフォーム、RelayState）
    - XXE攻撃への対策が不明確
  4. CORS設定
    - 全オリジン許可（allowedOrigins: ["*"]）
  5. エラーハンドリング
    - 詳細なエラー情報が露出する可能性