SAMLv2 Failing with Zoom

sswami · 2 Jul 2021, 15:32

Jay Swaminarayan!

Hello @dan

It has been 2 weeks now that I am working with Zoom Premium support in connection with using FA as SAMLv2 IdP.

Everything seems to be configured properly but still, it fails.

Zoom as we know is a very widely used products and they (their engineering support) say they work with all popular IdPs, but they don't find this issue.

After a lot of working out, they said, it is probably failing due to "NotBefore" attribute in the Assertion>Conditions tag.

They say, this shouldn't be there. Now, I am not sure whats the issue.
Kindly help us.

sswami · 7 Feb 2021, 17:05

@robotdan You may also please look into this and tell me!

Zoom Error Message Says:
The signature is not trusted or invalid, please check the certificate.

Also, I could figure out to remove the tags and NotBefore attribute using lambda but still, the problem persists.

Zoom engineering team tried is also ready and trying its best to support FusionAuth. They said me if we figure this out it will be a support FusionAuth officially.

My ticket is still on.

Kindly help

robotdan · 7 Feb 2021, 19:51

After a lot of working out, they said, it is probably failing due to "NotBefore" attribute in the Assertion>Conditions tag.

This was fixed in 1.28.0.
https://github.com/FusionAuth/fusionauth-issues/issues/1215

robotdan · 2 Jul 2021, 19:52

@sswami said in SAMLv2 Failing with Zoom:

Zoom engineering team tried is also ready and trying its best to support FusionAuth. They said me if we figure this out it will be a support FusionAuth officially.

SAML is very complicated, I would recommend purchasing a paid support plan to get additional engineering assistance as you are doing with Zoom. This is likely a signing configuration error.

sswami · 13 Jul 2021, 05:23

@robotdan Jay Swaminarayan!
Thanx, however the issue was resolved yesterday, with the Required Lambda after trying multiple options.
Here are the steps from scratch to follow for FusionAuth Configuration to work with ZOOM SSO

The Steps to resolve this issue with FusionAuth & Zoom SSO
Tested with FusionAuth Version: 1.19+

Before FusionAuth, we would need Few settings from Zoom SSO

Login to Zoom Account > My Account > Advanced > Single Sign-On > Enable
Copy: Service Provider (SP) Entity ID setting, it should be either <vanity>.zoom.us or https://<vanity>.zoom.us/
You will need this for configuring Fusion Auth, (Yes, Zoom will not allow to save SAML until all the fields are filled, don't worry, we will come there later. keep zoom settings page open)

Now, lets create & configure FusionAuth App for zoom sso

Login to FusionAuth with Admin Access
Goto > Application > Create New Application As usual with Default Configuration.

Note: Before Configuring SAML Settings in FusionAuth, we need to create

SHA-256 Certificate with Proper Issuer required by Zoom
An appropriate Lambda Function to match the Response expected by Zoom
Follow these steps for both of this

CREATE SHA-256 CERTIFICATE FOR ZOOM

Go To > Settings > Key Master
"Generate RSA" From Top Right Drop Button

Name: Any Name, its for Identification, e.g. ZoomSAMLCertificateKey
Issuer: <vanity>.zoom.us (Should match the value set in Zoom's SAML "Service Provider (SP) Entity ID" setting)
Algorithm: RSA using SHA-256
Key lenght: 2048

Submit
==============================

CREATE SAML Populate Lambda as Required by Zoom

Go To > Customizations >Lambda > Add
Create New Lambda from top right [+] button

Name: Any Name for Identification: e.g. "SAML v2 Populate Lambda for Zoom App"
Type: SAML v2 Populate
Debug Enabled: as required

Body:

        function populate(samlResponse, user, registration) {
                    samlResponse.assertion.subject.subjectConfirmation.notBefore = null;
                    samlResponse.assertion.conditions.notBefore = null;
        }

Save
==============================

Now, we are ready to configure SAML settings in our App

Go To > Applications > Newly Created App > Enable SAML
Configure SAML Settings as following

Issuer: <vanity>.zoom.us (Should match the value set in Zoom's SAML "Service Provider (SP) Entity ID" setting)
Audience: leave it blank (default)
Callback URL (ACS): https://<vanity>.zoom.us/saml/SSO
Logout URL: https://<vanity>.zoom.us/ (or where ever to redirect after logout)
Signing key: Select the Key Generated in previous step e.g. "ZoomSAMLCertificateKey"
XML signature canonicalization method: Exclusive
Response populate lambda: Recently Created Lambda e.g. "SAML v2 Populate Lambda for Zoom App"
Debug Enabled: as required

Done, with FusionAuth, its ready for Zoom SSO

Now come to Zoom Page and Copy required settings from FusionAuth

You will have most details from the FusionAuth Application
Go to > Applications List > Click on our newly created Zoom App
Scroll to "SAML v2 Integration details" section

Get Zoom's SAML Settings from FusionAuth

Zoom's Sign-in Page URL:     <---     FA's Login URL
Zoom's Sign-out Page URL:     <---     FA's Logout URL
Zoom's Service Provider (SP) Entity ID == Select whatever you choose earlier as Issuer during Certificate Creation
Zoom's Issuer (IDP Entity ID):     <---     FA's Entity Id

Zoom's Identity Provider Certificate:     <---     
GoTo > FusionAuth's Settings > Key-Master > Click 🔍 on our Key generated for Zoom App
the value in "Base64 encoded" is to be used for Zoom's Identity Provider Certificate	

Zoom's Binding: HTTP-Redirect
Zoom's Signature Hash Algorithm: SHA-256
Zoom's Security: 
      Sign SAML request -- Unchecked
      Sign SAML Logout request -- Unchecked
      Support encrypted assertions -- Unchecked
      Enforce automatic logout after user has been logged in for -- Unchecked
      Save SAML response logs on user sign-in -- As Required
Zoom's Provision User: At Sign-in (Default) or As Required

[Save Changes] in Zoom
It's DONE! It should work as intended.
Note: there can be errors still, but mostly will not be related to SAML.

dan · 13 Jul 2021, 21:15

Thanks so much for writing this up @sswami !