Browser redirect from SP to IdP

Thu Feb 21 09:52:21 EST 2013

Scott,

Are there any best practices for cross domain deployments or any documentation that you can point me to?

Thanks,
Abba

-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of dev-request at shibboleth.net
Sent: Wednesday, February 20, 2013 11:53 AM
To: dev at shibboleth.net
Subject: dev Digest, Vol 20, Issue 8

Send dev mailing list submissions to
	dev at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/dev
or, via email, send a message with subject or body 'help' to
	dev-request at shibboleth.net

You can reach the person managing the list at
	dev-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than "Re: Contents of dev digest..."

Today's Topics:

   1. Browser redirect from SP to IdP (Abba Yadav)
   2. RE: Browser redirect from SP to IdP (Cantor, Scott)
   3. Re: OpenSAML Velocity templates for POST etc. responses
      (Michael A Grady)
   4. building IDP v2.3.8 .... (Steven Carmody)
   5. Re: building IDP v2.3.8 .... (Kevin P. Foote)
   6. Re: building IDP v2.3.8 .... (Ian Young)
   7. Re: OpenSAML Velocity templates for POST etc. responses
      (Cantor, Scott)

----------------------------------------------------------------------

Message: 1
Date: Tue, 19 Feb 2013 18:23:18 +0000
From: Abba Yadav <APY at usp.org>
Subject: Browser redirect from SP to IdP
To: "dev at shibboleth.net" <dev at shibboleth.net>
Message-ID:
	<4E9C6B8402296E47941F4C8060589820062C7688 at EXMBX1.HQ.USP.org>
Content-Type: text/plain; charset="us-ascii"

Has anyone experienced a browser security warning when redirecting from an SP to an IdP? We have several cross domain sites with a mix of http and https.

Abba
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130219/e6e524b8/attachment-0001.html 

------------------------------

Message: 2
Date: Tue, 19 Feb 2013 18:26:17 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Browser redirect from SP to IdP
To: Shib Dev <dev at shibboleth.net>
Message-ID:
	<BA63CEAE152A7742B854C678D94913835B2DFF95 at CIO-KRC-D1MBX01.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

> Has anyone experienced a browser security warning when redirecting 
> from an SP to an IdP? We have several cross domain sites with a mix of 
> http and https.

All the time, that's a client issue resulting from a questionable deployment choice that probably deserves a warning.

-- Scott

------------------------------

Message: 3
Date: Wed, 20 Feb 2013 09:45:20 -0600
From: Michael A Grady <mgrady at unicon.net>
Subject: Re: OpenSAML Velocity templates for POST etc. responses
To: Shib Dev <dev at shibboleth.net>
Message-ID: <BC433A12-95DE-4A74-B19C-163F4DB23EED at unicon.net>
Content-Type: text/plain; charset=us-ascii

On Feb 19, 2013, at 9:59 AM, Cantor, Scott wrote:

>>> Looking at the code, it seems if one simply injected the 
>>> "templateId" into
>> the context (actually, the velocityTemplateId), then one would have 
>> the necessary information to pass to GA. (It would be a bit longer, 
>> "/templates/saml2-post-binding.vm", but it would work. And/or one 
>> could then do string manipulation in the template to remove the 
>> "extraneous bits".
> 
> Sure, but why would anybody want to do logic based on an arbitrary filename vs. a standard-defined identifier? The filenames can change any time (which is why overriding the entire template isn't exactly kosher at present).

That would be ok (the filenames changing), as long as they retain different names and the name has anything to do with the "action/event" it is associated with (e.g. SAML2 POST, SAML1 POST, etc.). This "name" isn't important enough to be worth creating yet another configuration option for, it just provides one more way to potentially differentiate/sort the results.

Think of this value as a bit like an entityID -- it's just an internal name, so what it is, exactly, doesn't matter. It just provides one more way for the IdP operator to sort how they see their stats. It's not a name that they'd need to expose to anyone else.

> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to 
> dev-unsubscribe at shibboleth.net

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.

------------------------------

Message: 4
Date: Wed, 20 Feb 2013 10:46:34 -0500
From: Steven Carmody <steven_carmody at brown.edu>
Subject: building IDP v2.3.8 ....
To: "Shib Dev (dev at shibboleth.net)" <dev at shibboleth.net>
Message-ID: <5124EFDA.8010705 at brown.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Hi,

We're interested in looking at the src for current stable IDP release. 
We're following the directions on this page:

https://wiki.shibboleth.net/confluence/display/SHIB2/SourceAccess

However, I'm having some trouble pulling src from svn. If I type

svn co https://svn.shibboleth.net/java-opensaml2-main/branches/REL_2
java-opensaml2-main

it pulls a lot of files, but stops with:

>  U java-opensaml2-main/java-xmltooling
> svn: Invalid svn:externals property on 
> 'java-opensaml2-main/java-xmltooling': target involves '.' or '..' or 
> is an absolute path

pulling the main IDP src also gives a similar error.

Is the problem that these svn commands are pulling the development files (potential 2.4 release), and NOT the files for the stable 2.3.8 release ?

------------------------------

Message: 5
Date: Wed, 20 Feb 2013 11:40:16 -0500 (EST)
From: "Kevin P. Foote" <kpfoote at iup.edu>
Subject: Re: building IDP v2.3.8 ....
To: Shib Dev <dev at shibboleth.net>
Message-ID: <alpine.LFD.2.03.1302201133260.23666 at iup.edu>
Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII

On Wed, 20 Feb 2013, Steven Carmody wrote:

> svn co https://svn.shibboleth.net/java-opensaml2-main/branches/REL_2

Odd works here.. don't know if someone just changed something but I can
fetch via svn or git-svn just fine. (all the shib related code)

>
> pulling the main IDP src also gives a similar error.
>
> Is the problem that these svn commands are pulling the development files
> (potential 2.4 release), and NOT the files for the stable 2.3.8 release ?

These are most definitely the 2.4.0-SNAPSHOT versions.. To get 2.3.8 you
would have to pull at a specific rev .. looks like 3114 or there abouts
for the IdP anyway..

------
thanks
  kevin.foote

------------------------------

Message: 6
Date: Wed, 20 Feb 2013 16:45:26 +0000
From: Ian Young <ian at iay.org.uk>
Subject: Re: building IDP v2.3.8 ....
To: Shib Dev <dev at shibboleth.net>
Message-ID: <FFCE009F-ACA9-4AF3-A632-83980071CEF8 at iay.org.uk>
Content-Type: text/plain; charset="us-ascii"

On 20 Feb 2013, at 16:40, "Kevin P. Foote" <kpfoote at iup.edu> wrote:

> To get 2.3.8 you
> would have to pull at a specific rev .. looks like 3114 or there abouts
> for the IdP anyway..

To rebuild a specific release version, you need to pull from the specific *tag*, not from the main line.  The latter will usually work (more or less) if you pick the right spot, but the tag is definitive.

	-- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130220/b806fbc9/attachment-0001.bin 

------------------------------

Message: 7
Date: Wed, 20 Feb 2013 16:52:38 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: Re: OpenSAML Velocity templates for POST etc. responses
To: Shib Dev <dev at shibboleth.net>
Message-ID:
	<BA63CEAE152A7742B854C678D94913835B2E0BA2 at CIO-KRC-D1MBX01.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

On 2/20/13 10:45 AM, "Michael A Grady" <mgrady at unicon.net> wrote:
>
>That would be ok (the filenames changing), as long as they retain
>different names and the name has anything to do with the "action/event"
>it is associated with (e.g. SAML2 POST, SAML1 POST, etc.). This "name"
>isn't important enough to be worth creating yet another configuration
>option for, it just provides one more way to potentially
>differentiate/sort the results.

It wouldn't be a new option, it's an existing piece of data on the message
encoder (the binding is there as a property).

-- Scott

------------------------------

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

End of dev Digest, Vol 20, Issue 8
**********************************