Should IDP/SP metadata contain a roleDescriptor tag?

[Wessel, Keith William]

Following up on this, I think that Siteminder is being pickier than the SAML standards, and I'm looking for confirmation of that.

There are two ways to make Siteminder happy with recognizing an SP as SAML 2.0 compliant. You can either, as you described earlier, Tom, use a roleDescriptor tag that explicitly states that the entity uses the SAML 2.0 standard or you can specify the supported protocols in increasing numerical order as attributes to the spSSODescriptor tag. That is if you specify the supported protocols in the order ot 1.1, 2.0, it'll recognize it as 2.0. If you specify it as 2.0, 1.1, it'll only recognize it as 1.1. Our metagen.sh script is creating metadata that lists the protocols in decreasing numerical order, but the Shibboleth IDP is fine with that. The Siteminder IDP is not.

Is the Shib IDP just extra forgiving, or is Siteminder not following the standards?

Thanks,
Keith


-----Original Message-----
From: Wessel, Keith William 
Sent: Monday, July 09, 2012 12:57 PM
To: Shib Users
Subject: RE: Should IDP/SP metadata contain a roleDescriptor tag?

Thanks, Tom. Yes, we already grabbed the off-line schema files a while back for our own validation purposes. Thanks for mentioning it, though.

And no, this is CA Siteminder, not AD FS.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Monday, July 09, 2012 11:45 AM
To: Shib Users
Subject: Re: Should IDP/SP metadata contain a roleDescriptor tag?

On Mon, Jul 9, 2012 at 12:38 PM, Wessel, Keith William <kwessel at illinois.edu> wrote:
>
> Since we're not going to find roleDescriptor tags in the InCommon metadata but rather the derived tags for idpSSODescriptor and spSSODescriptor, I think the vendor's going to need to sort this out if, in fact, it does insist on roleDescriptor. That's still unclear.

May I ask, is this AD FS? I recall seeing this kind of thing in the AD FS docs.

> At any rate, I appreciate the info... and the suggesting of running it through validation. By validation, I assume you're referring to xmlsectool, correct?

Yes, xmlsectool is what we use. There is a set of schema files on the previously mentioned wiki page that lets you do offline schema validation. (If you try to schema validate without them, the network might get in your way.)

Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net