SAML XML

[Nate Klingenstein]

Chance,

The verbiage in the email makes me a little suspect about the level of  
familiarity the vendor has with SAML, particularly if they consider  
receiving and processing an XML message as not operating and  
maintaining an SP.

That said, what they basically want is IdP-initiated SSO with an  
assertion that contains the username as an attribute.  Shibboleth  
makes this easy as of 2.3.x.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO

The SHIRE is the "url we would specify".  The providerId is their  
entityID.  The target is the destination page.

If they can make use of something like eduPersonPrincipalName or uid  
as a way to get the username, that's great.  Otherwise you'll have to  
define a custom attribute for them, and we would ask that you do so in  
a namespace you control.  If it comes to that and you need help, let  
us know.

Hope this helps,
Nate.


On Aug 1, 2011, at 19:52 , Chance Cox wrote:

> This is a snippet from an email I received this week. This vendor  
> does not want to maintain an SP, however they do have a SAML system  
> setup. Can anyone help me understand if this is possible, and how i  
> would go about doing it?
>
> Thanks in advance for any help.
>
> ----------------------------------------------------------------
> The way that the SAML framework operates.  When you authenticate a  
> user on your portal, you can provide a link or button there to send  
> send an xml file to a url we would specify.  That xml file will be  
> in the SAML framework – encrypted and would contain the institution  
> ID – Elon – and the user’s username.  That is sufficient for us to  
> authenticate the user.
>
> Shibboleth uses SAML and should be able to generate the required xml  
> file.  For more on SAML, see:
>
> http://en.wikipedia.org/wiki/Security_Assertion_Markup_Language
>
> As we don’t have any working knowledge of the implementation of the  
> Shibboleth system, I think you will have to work out on your own how  
> to actually make this happen.  When you are in a position to  
> generate the xml file, let us know and we will provide a URL for you  
> to point to.  We can then begin testing.  We won’t create the url  
> (or rather the processing page behind it) until you are able to  
> generate the xml file as we will need that to know how to interpret  
> and parse it.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20110801/eb102e43/attachment.html