topic Re: Cannot generate session ticket in Cloud Collaboration

Cannot generate session ticket

jeanborgonia — Tue, 14 Jun 2016 08:18:26 GMT

Hi all

I am pretty new to WebEx dev. My problem is I cant get a session ticket from the response xml of authenticate function. I am passing the username and a samlResponse. I generated the samlResponse using a modified version of the sample code found on this website: How to create a valid SAML 2.0 Assertion with OpenSAML for JAVA | Keksrolle.de. Whenever I send the request with the assertion, I get a result of SUCCESS but without a session ticket. I am guessing that the values in my assertion are wrong hence I am not getting the session ticket.

Anyone knows why this happens?

Re: Cannot generate session ticket

kinglewi — Tue, 14 Jun 2016 21:06:51 GMT

Can you show the full response you are getting back from the server? If you are getting a success there should be a body with more information on the response. With AuthenticateAccount, you have to have access either to the IDMS to provide the assertion, or the public/private key pair that is used during normal SAML login flow for webex, this would be used to create your own assertions.

AuthenticateAccount defaults to using protocol 1.1, so make sure you also use 2.0 in the protocol tag.

Re: Cannot generate session ticket

jeanborgonia — Wed, 15 Jun 2016 00:12:40 GMT

Hi kinglewi

What do you mean by "access to the IDMS"? How do we use this to create our assertion?

Below is the request I sent to the server

<?xml version="1.0" encoding="UTF-8"?>

<serv:message xmlns:serv="http://www.webex.com/schemas/2002/06/service" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<webExID>testuser123</webExID>

</securityContext>

</header>

<body>

<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" IssueInstant="2016-06-14T02:08:03.130Z" Version="2.0">

<saml2:Issuer>https://ourwebexsite.webex.com</saml2:Issuer>

<saml2:Conditions>

<saml2:OneTimeUse />

</saml2:Conditions>

<saml2:AuthnStatement AuthnInstant="2016-06-14T02:08:03.162Z" SessionIndex="abcdedf1234567" SessionNotOnOrAfter="2016-06-14T02:08:03.177Z">

<saml2:AuthnContext>

<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>

</saml2:AuthnContext>

</saml2:AuthnStatement>

<saml2:AttributeStatement>

<saml2:Attribute Name="FirstName">

<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">myFirstName</saml2:AttributeValue>

</saml2:Attribute>

<saml2:Attribute Name="LastName">

<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">myLastName</saml2:AttributeValue>

</saml2:Attribute>

</saml2:AttributeStatement>

</saml2:Assertion>

</samlResponse>

</bodyContent>

</body>

</serv:message>

Below is the response I am getting from the server

<?xml version="1.0" encoding="UTF-8"?>

<serv:message xmlns:serv="http://www.webex.com/schemas/2002/06/service" xmlns:com="http://www.webex.com/schemas/2002/06/common" xmlns:use="http://www.webex.com/schemas/2002/06/service/user">

<serv:header>

<serv:response>

<serv:result>SUCCESS</serv:result>

<serv:gsbStatus>PRIMARY</serv:gsbStatus>

</serv:response>

</serv:header>

<serv:body>

<serv:bodyContent xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="use:authenticateUserResponse" />

</serv:body>

</serv:message>

Re: Cannot generate session ticket

kinglewi — Wed, 15 Jun 2016 03:20:41 GMT

Hi Rejean,

IDMS is the Identity Managment System and its used to create assertions on behalf of a user. If your site is not using SAML or an IDMS then you do not need to use AuthenticateUser.

The assertion actually has to be base64 encoded, an example would look like this

<?xml version="1.0" encoding="UTF-8"?>

<serv:message xmlns:serv="http://www.webex.com/schemas/2002/06/service" xmlns:com="http://www.webex.com/schemas/2002/06/common"

xmlns:use="http://www.webex.com/schemas/2002/06/service/user">

<serv:header>

<serv:securityContext>

<com:webExID>{{username}}</com:webExID>

<com:siteName>{{sitename}}</com:siteName>

</serv:securityContext>

</serv:header>

<serv:body>

<serv:bodyContent xsi:type="java:com.webex.xmlapi.service.binding.user.AuthenticateUser">

<use:samlResponse>

PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxSZXNwb25zZSB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiIElEPSJjcGhwZGZvaHBnbmZkbGdjZWFta2VpZGZmYWhkbWppYmVlZWZpa2FuIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMTItMDJUMjI6NDc6MjhaIiBWZXJzaW9uPSIyLjAiIEluUmVzcG9uc2VUbz0iIj4JPG5zMjpJc3N1ZXIgeG1sbnM6bnMyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5LaW5nc2xleUxld2lzPC9uczI6SXNzdWVyPgk8U3RhdHVzPgkJPFN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIgLz4JPC9TdGF0dXM+CTxuczI6QXNzZXJ0aW9uIHhtbG5zOm5zMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9ImZjYmNpY2NkY2lib2NwYm9laGNha2JvbWJrZnBvb2NsbWRlaGFqbGEiIElzc3VlSW5zdGFudD0iMjAxNC0xMi0wMlQyMjo0NzoyOFoiIFZlcnNpb249IjIuMCI+CQk8bnMyOklzc3Vlcj5LaW5nc2xleUxld2lzCQk8L25zMjpJc3N1ZXI+CQk8ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj48ZHM6U2lnbmVkSW5mbz48ZHM6Q2Fub25pY2FsaXphdGlvbk1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIgLz48ZHM6U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3JzYS1zaGExIiAvPjxkczpSZWZlcmVuY2UgVVJJPSIjZmNiY2ljY2RjaWJvY3Bib2VoY2FrYm9tYmtmcG9vY2xtZGVoYWpsYSI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIiAvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiIC8+PGRzOkRpZ2VzdFZhbHVlPjIwNUxRU1ZuenVrYWpQOHlTamJSQTJBNGNOTT08L2RzOkRpZ2VzdFZhbHVlPjwvZHM6UmVmZXJlbmNlPjwvZHM6U2lnbmVkSW5mbz48ZHM6U2lnbmF0dXJlVmFsdWU+QTlvYjFuZXd5R3RLRWdEWWIyVHNwOHFhZGNEY1V1SDRlYkFCSVhqenNQZkNEOGwxUU1NaVBBVG5uSFpBd2tUaDMwNjMvbGJjeW1DZQ0KQnRmUzFIZElvVTNoajI0My9URTZ5UzRGVmJBUnNKZ0RwTmYrK3lseUgwbTRmeWF6Wm5PRFJEZUN5bWppSmdwcjJ3V3dqRjJ5RFZaQQ0KSXNZdWJGR0o2TWZOTXEyUTdFOD08L2RzOlNpZ25hdHVyZVZhbHVlPjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOVN1YmplY3ROYW1lPkNOPUtpbmdzbGV5IExld2lzLE89Q2lzY28sT1U9V2ViRXgsTD1TYWNyYW1lbnRvLFNUPUNhbGlmb3JuaWEsQz1VUzwvZHM6WDUwOVN1YmplY3ROYW1lPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJQ1dUQ0NBY0tnQXdJQkFnSUdBVFdDZENJQ01BMEdDU3FHU0liM0RRRUJCUVVBTUhBeEN6QUpCZ05WQkFZVEFsVlRNUk13RVFZRA0KVlFRSUV3cERZV3hwWm05eWJtbGhNUk13RVFZRFZRUUhFd3BUWVdOeVlXMWxiblJ2TVE0d0RBWURWUVFMRXdWWFpXSkZlREVPTUF3Rw0KQTFVRUNoTUZRMmx6WTI4eEZ6QVZCZ05WQkFNVERrdHBibWR6YkdWNUlFeGxkMmx6TUI0WERURXlNREl4TlRFNU1Ua3dNMW9YRFRFMw0KTURJeU5ERTVNVGt3TTFvd2NERUxNQWtHQTFVRUJoTUNWVk14RXpBUkJnTlZCQWdUQ2tOaGJHbG1iM0p1YVdFeEV6QVJCZ05WQkFjVA0KQ2xOaFkzSmhiV1Z1ZEc4eERqQU1CZ05WQkFzVEJWZGxZa1Y0TVE0d0RBWURWUVFLRXdWRGFYTmpiekVYTUJVR0ExVUVBeE1PUzJsdQ0KWjNOc1pYa2dUR1YzYVhNd2daOHdEUVlKS29aSWh2Y05BUUVCQlFBRGdZMEFNSUdKQW9HQkFMZFlicHowWmd0UElSTmk2emEzWkhmZQ0KZDc5R2p6RXdnWU5CS2lDNWRxNlhFUVhRUHJWQ0tmd0pOUWhKc2pveW5YMzZOSFkzWTNHNkROVGpaU1ZHMktZOHBFOFBjQ2VhNTUwSA0KeTNvUC9nTUFXUUsvUlNrZUprS2JjYmc5eXRFaG9VU2ZmTXVUdzVMbUFDbm5GZUQySjVyQkhKSUh6Q2Q1c2RTOGRLbzJkUUNIQWdNQg0KQUFFd0RRWUpLb1pJaHZjTkFRRUZCUUFEZ1lFQVJ2czFYaytwUDRtZFc1VnBSZlJsTEJHNFpVZjFVWkNmZEQvbFY1S3VuUjJsblhNdg0KUkc0Y0RzOTRVTGNGNVhiUTl6cTdROUlWeFQ1dFRTQnRZbjcxK0FnenJrNXJleWIzQVRPNktPd1JSQWo1VWZyTGUzaWdRZFJLRGJYYQ0KOG9vWkpqU0d1NEZZK1d3SFpGWGNDMzQ2ZE5ZNnN4QUU0eXppczlTcDVWaHY4STg9PC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PG5zMjpTdWJqZWN0PgkJCTxuczI6TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPgkJCQlrbGV3aXMJCQk8L25zMjpOYW1lSUQ+CQkJPG5zMjpTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI+CQkJCTxuczI6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgSW5SZXNwb25zZVRvPSIiIE5vdE9uT3JBZnRlcj0iMjAxNC0xMi0wMlQyMjo1MDoyOFoiIFJlY2lwaWVudD0iaHR0cHM6Ly9hY21ldHNwMjEud2ViZXguY29tL2Rpc3BhdGNoZXIvU0FNTDJBdXRoU2VydmljZT9zaXRldXJsPWFjbWV0c3AyMSZhbXA7cGFydG5lcj1LaW5nc1RlY2gmYW1wO1RZUEU9UFQiIC8+CQkJCTwvbnMyOlN1YmplY3RDb25maXJtYXRpb24+CQk8L25zMjpTdWJqZWN0PgkJPG5zMjpDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxNC0xMi0wMlQyMjo0NDoyOFoiIE5vdE9uT3JBZnRlcj0iMjAxNC0xMi0wMlQyMjo1MDoyOFoiPgkJCTxuczI6QXVkaWVuY2VSZXN0cmljdGlvbj4JCQkJPG5zMjpBdWRpZW5jZT5odHRwOi8vd3d3LndlYmV4LmNvbTwvbnMyOkF1ZGllbmNlPgkJCTwvbnMyOkF1ZGllbmNlUmVzdHJpY3Rpb24+CQk8L25zMjpDb25kaXRpb25zPgkJPG5zMjpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTQtMTItMDJUMjI6NDc6MjhaIj4JCQk8bnMyOkF1dGhuQ29udGV4dD4JCQkJPG5zMjpBdXRobkNvbnRleHRDbGFzc1JlZj4JCQkJCXVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkUHJvdGVjdGVkVHJhbnNwb3J0CQkJCTwvbnMyOkF1dGhuQ29udGV4dENsYXNzUmVmPgkJCTwvbnMyOkF1dGhuQ29udGV4dD4JCTwvbnMyOkF1dGhuU3RhdGVtZW50PgkJPG5zMjpBdHRyaWJ1dGVTdGF0ZW1lbnQ+PG5zMjpBdHRyaWJ1dGUgTmFtZT0idWlkIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVuc3BlY2lmaWVkIj48bnMyOkF0dHJpYnV0ZVZhbHVlPmtsZXdpczwvbnMyOkF0dHJpYnV0ZVZhbHVlPjwvbnMyOkF0dHJpYnV0ZT48bnMyOkF0dHJpYnV0ZSBOYW1lPSJlbWFpbCIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1bnNwZWNpZmllZCI+PG5zMjpBdHRyaWJ1dGVWYWx1ZT5kYmVzQG5vcmVwbGllcy53ZWJleC5jb208L25zMjpBdHRyaWJ1dGVWYWx1ZT48L25zMjpBdHRyaWJ1dGU+PG5zMjpBdHRyaWJ1dGUgTmFtZT0ibGFzdG5hbWUiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dW5zcGVjaWZpZWQiPjxuczI6QXR0cmlidXRlVmFsdWU+TGV3aXNlczwvbnMyOkF0dHJpYnV0ZVZhbHVlPjwvbnMyOkF0dHJpYnV0ZT48bnMyOkF0dHJpYnV0ZSBOYW1lPSJmaXJzdG5hbWUiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dW5zcGVjaWZpZWQiPjxuczI6QXR0cmlidXRlVmFsdWU+S2luZ3NsZXllczwvbnMyOkF0dHJpYnV0ZVZhbHVlPjwvbnMyOkF0dHJpYnV0ZT48L25zMjpBdHRyaWJ1dGVTdGF0ZW1lbnQ+CTwvbnMyOkFzc2VydGlvbj48L1Jlc3BvbnNlPg0K

</use:samlResponse>

</serv:bodyContent>

</serv:body>

</serv:message>

Re: Cannot generate session ticket

jeanborgonia — Thu, 16 Jun 2016 01:14:26 GMT

Is it possible to generate this assertion by myself even if I have no access to the IDMS or the keys?

Re: Cannot generate session ticket

ryanhunt — Fri, 17 Jun 2016 18:47:44 GMT

Hi Rejean,

IDMS Access is a requirement for generating an assertion, its not possible without access.

Re: Cannot generate session ticket

jeanborgonia — Mon, 20 Jun 2016 04:50:47 GMT

Thanks for the replies.

Our site is using SAML 2.0.

Apologies for repeating, but I am missing something in your responses as I'm new to WebEx dev.

You've both indicated I need to access the IDMS and get it to generate an assertion, but I am unsure how I am supposed to access it, and once I do access it, how I get it to generate an assertion for me.

Do you have any further details around how this is done?

Re: Cannot generate session ticket

ryanhunt — Fri, 24 Jun 2016 20:12:12 GMT

I am sorry but we do not have this information, you'll need to contact your network admins for these kind of details..

Unfortunately SAML/SSO are not related WebEx Developer APIs, therefore this is not the appropriate place to seek guidance with these types of issues.