[EVAKA-HOTFIX] Harden SAML configuration for replay attacks, audience confusion

[mikkopiu]

Summary

This is part 2 of the SAML configuration hardenings/fixes as reported by a white hat. SLO fixes are in progress in #738 and InResponseTo checking will follow later.

• APIGW: Enable SAML audience checking
  • Audience checking for SAML responses is one way to prevent attackers from reusing e.g. login responses intended for another SP (from a trusted IdP) to log into eVaka
    • Without audience checking, eVaka would only check that the message came from a trusted IdP and would allow login/logout -> any user that can log in the IdP (AD mainly, in this case) can log into eVaka even if the IdP wouldn't permit it (e.g. missing AD role to access eVaka)
  • Add new configuration for "eVaka SAML" (i.e. Keycloak), EVAKA_SAML_ISSUER for use as the expected audience (same for Suomi.fi and AD but they already have equivalent configs exposed)
• APIGW: Enable notOnOrAfter SAML validation
  • This limits replay attack feasibility by enabling the SAML notOnOrAfter checks in passport-saml meaning that responses are only valid as long as described by themselves in the aforementioned property
  • The value -1 for acceptedClockSkewMs disables this check completely, meaning that SAML responses can be replayed indefinitely (or at least while the certificates in them are valid)

Dependencies

• https://github.com/espoon-voltti/evaka-infra/pull/401