Should IDP/SP metadata contain a roleDescriptor tag?

[Wessel, Keith William]

Thanks for the sanity check, Tom. This is exactly what I suspected was the case, but I needed to hear it from someone else.

Since we're not going to find roleDescriptor tags in the InCommon metadata but rather the derived tags for idpSSODescriptor and spSSODescriptor, I think the vendor's going to need to sort this out if, in fact, it does insist on roleDescriptor. That's still unclear.

At any rate, I appreciate the info... and the suggesting of running it through validation. By validation, I assume you're referring to xmlsectool, correct?

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Monday, July 09, 2012 5:54 AM
To: Shib Users
Subject: Re: Should IDP/SP metadata contain a roleDescriptor tag?

Hi Keith,

On Sun, Jul 8, 2012 at 11:09 PM, Wessel, Keith William
<kwessel at illinois.edu> wrote:
>
> The vendor claims that the XML generated by Shibboleth's metagen.sh is flawed because it doesn't contain a <roleDescriptor> tag. I argued back that roleDescriptor is abstract and not meant to be used literally; rather, spSSODescriptor or idpSSODescriptor should be used.

RoleDescriptor is indeed abstract but it can be used literally as long
as a type is specified. Here's an example:

<md:RoleDescriptor
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:query="urn:oasis:names:tc:SAML:metadata:ext:query"
    xsi:type="query:AttributeQueryDescriptorType"
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">

For details, see this spec that Scott and I co-authored a long time ago:

https://wiki.oasis-open.org/security/SstcSamlMetadataExtQuery

> The vendor responded, in explaining what was wrong with the metagen.sh generated metadata:
>
> The <RoleDescriptor> tag has to be in front of the "protocolSupportEnumeration" tag.

To be precise, <RoleDescriptor> is an element and
protocolSupportEnumeration is an XML attribute, but no, you shouldn't
use RoleDescriptor to denote an IdP or an SP. You should use
IDPSSODescriptor and SPSSODescriptor for that.

I suppose you *could* write the equivalent of IDPSSODescriptor and
SPSSODescriptor in terms of RoleDescriptor, but I haven't tried that.
My guess is that it would be schema-valid.

> This is because EntityDescriptor is picking up the SAML 1.1 version for the EntityId since there is nothing in front of those white space separated protocols listed
> in the "protocolSupportEnumeration" signifying it is not part of EntityID but should be part of the RoleDescriptor.

I have no idea what that sentence is trying to say.

> Personally, I don't think the vendor's statement explains why they need roleDescriptor with spSSODescriptor is already there. The issue that generated all of this is that the vendor, acting as an IDP, is reading in metadata on one of our SPs and recognizing it as only SAML 1.1 capable which it, obviously, is more than that.

Well then they're doing something wrong.

> Can someone more well-versed in SAML help me out here?

It's a simple matter to show whether a SAML metadata file is
schema-valid. Instructions for showing InCommon metadata to be
schema-valid are in the spaces wiki
(https://spaces.internet2.edu/x/JwQjAQ). There's even a set of schema
files attached to that page.

There's no point in wasting cycles debating whether or not a chunk of
code is valid. Just run it through the validator and see what happens.

Hope this helps,
Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net