Shibboleth SP receives unsolicited SSO

[Cantor, Scott]

On 12/9/11 3:37 PM, "Paul Weitz" <pawreg at lifeimage.com> wrote:
>
>I would like to use the shibboleth SP as follows. I believe that this is
>a unsolicited SSO scenario but I am not sure.

It is.

>5) The form post action is a URL at my service that is under the control
>of apache with shibboleth auth turned on.

No. The form action is to a SAML assertion consumer service exposed by the
SP, which is a handler living under /Shibboleth.sso and is known to the
IdP via SAML metadata or OOB configuration.

>6) shibd accepts and validates the SAML 2.0 assertion and returns the
>resource to the end-user.

shibd is an implementation detail of the SP. You should not think in terms
of it or what it does.

>My current problem is that when the request is received by shibd,

Your web server receives the request. The rest is an internal matter.

> the SP always wants to fetch metadata from an idP using the entityid and
>this fails.

The SP in all cases requires metadata for the entityID contained in the
response and assertion. If metadata lookup fails, then you didn't provide
metadata with the right entityID in it, or your IdP is incorrectly naming
itself.

> I have put the idP's x509 certificate into a metadata file and
>referenced the metadata file in the <MetaDataProvider> tag in
>shibboleth2.xml and I have configured the attribute-map.xml with the
>attributes I am expecting from the idP.

Then you just didn't do it correctly, and will have to actually explain
what happened.

>Am I operating in the wrong mode?

Not necessarily, but it's possible you provided the wrong URL to the IdP
to use and the form post is accomplishing nothing.

>Is there a particular document that describes what I need or am I just
>misinterpreting the standard SP setup documentation.

The latter.

-- Scott