Encrypted Assertions and IDP Unsolicited SSO

[Castellow, Robert]

Thanks Scott and Chad.  The message decoding not having prior information from the relying party lookup makes sense.  I'll go back and check all my configurations.  Thanks for your help.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
Sent: Saturday, March 31, 2012 2:29 PM
To: Shib Users
Subject: Re: Encrypted Assertions and IDP Unsolicited SSO

I'm with Scott, I can't see how the relying party definition would have anything to do with it.  The relying party config lookup doesn't (and can't) occur until the message is fully decoded.  The decoders themselves know nothing about, and have no access to, the relying party config.

On Fri, Mar 30, 2012 at 17:46, Castellow, Robert <castellr at musc.edu> wrote:
> Hello:
>
> I am attempting to disable encryption on assertions specifically for a 
> vendor who requires IDP unsolicited SSO and unencrypted assertions:
>
>
>
> The following steps were completed after adding our vendor SP into the
> metdata:
>
> 1.)    Added an entry to relying-party.xml (the DefaultRelyingParty 
> for the SAML2SSOProfile has encryptAssertions="conditional") :
>
>         <rp:RelyingParty id="https://kod.musc.edu"
>
>                 provider="https://shibboleth.musc.edu/shibboleth-idp"
>
>                 defaultSigningCredentialRef="musc_creds">
>
>                <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
> encryptAssertions="never" />
>
>         </rp:RelyingParty>
>
> 2.)    The following URL is tested:
>  
> https://shibboleth-v.musc.edu/shibboleth-idp/profile/SAML2/Unsolicited
> /SSO?providerId=https%3A%2F%2Fkod.musc.edu
>
>
>
> and the following error is received:
>
> 17:18:58.178 - INFO [Shibboleth-Access:74] -
> 20120330T211858Z|128.23.43.89|shibboleth-v.musc.edu:443|/profile/SAML2
> 20120330T211858Z|/Unsolicited/SSO|
>
> 17:18:58.179 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSOD
> ecoder:157]
> - No providerId parameter given in unsolicited SSO authentication request.
>
> 17:18:58.180 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandl
> er:373]
> - Error decoding authentication request message
>
> org.opensaml.ws.message.decoder.MessageDecodingException: No 
> providerId parameter given in unsolicited SSO authentication request.
>
>
>
>
>
> This all works if the relying party entry from #1 is never added and 
> the defaultRelyingParty for the SAML2SSOProfile type is set to 
> encryptAssertions="never" , but I'm failing to make this configuration 
> vendor specific.  What would cause my providerId to be dropped when I 
> add this entry to the relying-party.xml?
>
>
>
> Thanks in advance.
>
>
>
> Rob Castellow
>
> Systems Engineer
>
> IAS, OCIO
>
> Medical University of South Carolina
>
>
>
>
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net



--
Chad La Joie
www.itumi.biz
trusted identities, delivered
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net