Encrypted Assertions and IDP Unsolicited SSO

[Chad La Joie]

I'm with Scott, I can't see how the relying party definition would
have anything to do with it.  The relying party config lookup doesn't
(and can't) occur until the message is fully decoded.  The decoders
themselves know nothing about, and have no access to, the relying
party config.

On Fri, Mar 30, 2012 at 17:46, Castellow, Robert <castellr at musc.edu> wrote:
> Hello:
>
> I am attempting to disable encryption on assertions specifically for a
> vendor who requires IDP unsolicited SSO and unencrypted assertions:
>
>
>
> The following steps were completed after adding our vendor SP into the
> metdata:
>
> 1.)    Added an entry to relying-party.xml (the DefaultRelyingParty for the
> SAML2SSOProfile has encryptAssertions=”conditional”) :
>
>         <rp:RelyingParty id="https://kod.musc.edu"
>
>                 provider="https://shibboleth.musc.edu/shibboleth-idp"
>
>                 defaultSigningCredentialRef="musc_creds">
>
>                <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
> encryptAssertions="never" />
>
>         </rp:RelyingParty>
>
> 2.)    The following URL is tested:
>  https://shibboleth-v.musc.edu/shibboleth-idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fkod.musc.edu
>
>
>
> and the following error is received:
>
> 17:18:58.178 - INFO [Shibboleth-Access:74] -
> 20120330T211858Z|128.23.43.89|shibboleth-v.musc.edu:443|/profile/SAML2/Unsolicited/SSO|
>
> 17:18:58.179 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSODecoder:157]
> - No providerId parameter given in unsolicited SSO authentication request.
>
> 17:18:58.180 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:373]
> - Error decoding authentication request message
>
> org.opensaml.ws.message.decoder.MessageDecodingException: No providerId
> parameter given in unsolicited SSO authentication request.
>
>
>
>
>
> This all works if the relying party entry from #1 is never added and the
> defaultRelyingParty for the SAML2SSOProfile type is set to
> encryptAssertions=”never” , but I’m failing to make this configuration
> vendor specific.  What would cause my providerId to be dropped when I add
> this entry to the relying-party.xml?
>
>
>
> Thanks in advance.
>
>
>
> Rob Castellow
>
> Systems Engineer
>
> IAS, OCIO
>
> Medical University of South Carolina
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered