Any "gotchas" to adding in SAML 2 support?

[Eric Goodman]

On Thu, Jul 5, 2012 at 4:42 PM, Tom Scavo <trscavo at gmail.com> wrote:

> On Thu, Jul 5, 2012 at 7:11 PM, Eric Goodman <ericg at ucsc.edu> wrote:
> >
> > We are running IdP 2.x, and we have been publishing SAML2 endpoints to
> > several non-InCommon SPs.
>
> What bindings do you support? Is HTTP-Redirect one of them?
>

In the SAML2, yes. Not in the current InCommon data.

> However, the metadata we currently publish through
> > InCommon is all SAML1. We would like to add our SAML2 endpoints into our
> > InCommon metadata.
>
> That would be great :-)
>
> > My question for the group is: are there any gotchas with doing this?
> After
> > looking through the troubleshooting pages on the wiki, it seems like the
> > most common mistake we could make is failing to update all of our relying
> > party configs to support SAML2 before the SAML2 endpoints are
> published, but
> > we're wondering if there are any other gotchas to look for on the IdP or
> SP
> > before making the change.
>
> Since you're already interoperating with a select group of SAML2 SPs,
> I'm not sure what you're asking. Seems like all the hard work has
> already been done.
>

I'm really just wondering if adding in the SAML2 can cause any confusion
for an SP that was using SAML1 previously. Most of our SAML2 SPs are
configured in our relying party to only have SAML2 support (not both SAML1
and SAML2), so I thought there might be a non-obvious way we could cause
some sort of confusion between existing SPs and IdPs when we update the
InCommon Metadata. And I figure there must be dozens of campuses that have
already made this change, so they would be able to tell us if there's
something to be wary of.

--- Eric
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120705/8cc60c97/attachment-0001.html