Simply SP setup

[Cantor, Scott]

On 12/5/11 11:44 AM, "AGoodspeed at cfglife.com" <AGoodspeed at cfglife.com>
wrote:

>I have Shibboleth SP 2.4.3 installed and
>working in Apache httpd 2.2 as far as the test URLs (Shibboleth.sso/Status
>and Shibboleth.sso/Metadata) are concerned. It is proving a challenge to
>wade through the documentation and find what I need for my setup though.

All we have is what we have.

>What I need is what I think was the
>only option under Shibboleth 1.x - a SP to handle an assertion initiated
>from a partner' web site.

That was not the only option, but regardless, anything it supported is
still supported.

> They will provide a link to our web site with
>whatever information we require; the payload of the link will probably
>require encryption to prevent spoofing.

Encryption doesn't have anything to do with preventing spoofing, but if
you desire XML Encryption of the assertion, then you would have to use
SAML 2.0, or forgo encryption and
rely on a TLS back channel for the data such as with the artifact binding
or relying on attribute queries.

> This will be the only way their
>users will access our web site so I do not think that a link back to them
>as an IdP is needed, nor do I want to require that they establish
>something
>new to implement an IdP.

Then they're doing unsolicited SSO to you. The default ACS locations can
be found by examining the sample metadata it generates. If they cannot
push a target or relay state value to you that identifies the intended
resource, then your system will have to rely on a fixed destination to
redirect to, normally set using the homeURL property in the
<ApplicationDefaults> element. There's not much else to it.

>Is there a roadmap available for implementing
>such a setup? Shibboleth is new for me, so a roadmap for dummies would
>be ideal.

And difficult and expensive to produce.

If there's something you don't understand, then identifying what that is
is the only way the documentation will get any better. We have no ability
to act on "I can't follow it". If we knew how to organize it better, it
would be organized that way already.

-- Scott