Metadata question for Embedded Discovery and SP authentication of IdP

[Jason Bau]

On Tue, Aug 2, 2011 at 3:46 PM, Tom Scavo <trscavo at gmail.com> wrote:
> On Tue, Aug 2, 2011 at 6:41 PM, Tom Scavo <trscavo at gmail.com> wrote:
>> On Tue, Aug 2, 2011 at 4:47 PM, Jason Bau <jasonbau at gmail.com> wrote:
>>>
>>> Here's my question:  is the expired cert to blame for my SP failing to
>>> authenticate the IdP?
>>
>> No, I'm pretty sure that's not it.
>
> Are you sure the SP's metadata has one or more SAML V2.0
> <md:AsssertionConsumerService> endpoints? Maybe your SP has been
> issuing SAML1 requests all along and you didn't realize that. Now it's
> issuing SAML2 requests without proper support in metadata. See the
> InCommon wiki (https://spaces.internet2.edu/x/FgEFAQ) for details.
>


Yes, I believe so.  From the InCommon metadata (and also available
directly from cware-dev2.stanford.edu):

<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://cware-dev2.stanford.edu/Shibboleth.sso/SAML2/POST"
index="1"/>
<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="https://cware-dev2.stanford.edu/Shibboleth.sso/SAML2/POST-SimpleSign"
index="2"/>
<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="https://cware-dev2.stanford.edu/Shibboleth.sso/SAML2/Artifact"
index="3"/>
<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
Location="https://cware-dev2.stanford.edu/Shibboleth.sso/SAML2/ECP"
index="4"/>


> Tom
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>