Shibboleth SP receives unsolicited SSO

[Paul Weitz]

Hi,

I have been attempting to configure the Shibboleth SP to meet my needs and
have not been successful.

I would like to use the shibboleth SP as follows. I believe that this is a
unsolicited SSO scenario but I am not sure.

0) A third party service has my service's x509 certificate
1) An end-user logs into a third party service
2) An end-user clicks on a link at said service that will eventually take
them to a well-known resource at my service
3) In response to the click, the third-party service generates a SAML 2.0
assertion, encrypted with my certificate and signed by their private key
and passes it to the end-user web browser in the form of an HTML form
4) The HTML form is auto-posted by calling a little javascript
ondocumentload.
5) The form post action is a URL at my service that is under the control of
apache with shibboleth auth turned on.
6) shibd accepts and validates the SAML 2.0 assertion and returns the
resource to the end-user.

My current problem is that when the request is received by shibd, the SP
always wants to fetch metadata from an idP using the entityid and this
fails. I have put the idP's x509 certificate into a metadata file and
referenced the metadata file in the <MetaDataProvider> tag in
shibboleth2.xml and I have configured the attribute-map.xml with the
attributes I am expecting from the idP.

Am I operating in the wrong mode? Is there a particular document that
describes what I need or am I just misinterpreting the standard SP setup
documentation.

Thanks,
Paul
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111209/a8b9431e/attachment.html