Should IDP/SP metadata contain a roleDescriptor tag?

[Wessel, Keith William]

Hi,

Need help either confirming my misunderstanding of SAML or convincing a vendor that they're confused.

The vendor claims that the XML generated by Shibboleth's metagen.sh is flawed because it doesn't contain a <roleDescriptor> tag. I argued back that roleDescriptor is abstract and not meant to be used literally; rather, spSSODescriptor or idpSSODescriptor should be used.

The vendor responded, in explaining what was wrong with the metagen.sh generated metadata:

The <RoleDescriptor> tag has to be in front of the "protocolSupportEnumeration" tag.  This is because EntityDescriptor is picking up the SAML 1.1 version for the EntityId since there is nothing in front of those white space separated protocols listed 
in the "protocolSupportEnumeration" signifying it is not part of EntityID but should be part of the RoleDescriptor.

Personally, I don't think the vendor's statement explains why they need roleDescriptor with spSSODescriptor is already there. The issue that generated all of this is that the vendor, acting as an IDP, is reading in metadata on one of our SPs and recognizing it as only SAML 1.1 capable which it, obviously, is more than that.

Can someone more well-versed in SAML help me out here?

Thanks,
Keith