SAML2ECP profile is not configured for relying party 'urn:federation:MicrosoftOnline'

[Ryan Larscheidt]

This relying party configuration works for us:

    <rp:RelyingParty id="urn:federation:MicrosoftOnline"
                  provider="${entityid}"
                  defaultSigningCredentialRef="IdPCredential">
        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" signAssertions="conditional" encryptAssertions="never" encryptNameIds="never" />
        <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" signAssertions="conditional" encryptAssertions="never" encryptNameIds="never" />
    </rp:RelyingParty>    

Thanks,
Ryan

On Oct 12, 2012, at 09:36 , Ryan Suarez <ryan.suarez at sheridanc.on.ca> wrote:

> On 12-10-12 10:11 AM, Cantor, Scott wrote:
>> You apparently created a dedicated RelyingParty definition and it doesn't
>> contain the ECP profile config element in relying-party.xml.
>> Alternatively, if it's using the DefaultRelyingParty element, the profile
>> isn't there either.
>> 
>> It was added, I believe, to the default file in newer versions, but it
>> can't be there if you upgraded and didn't add it.
> 
> Right.  Upgraded the IdP (to v2.3.6) and had to manually add all the ECP 
> bits, which I copied from a clean install of v2.3.8:
> 
> relying-party.xml
>         <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" 
> includeAttributeStatement="true"
>                                  assertionLifetime="PT5M" 
> assertionProxyCount="0"
>                                  signResponses="never" 
> signAssertions="always"
>                                  encryptAssertions="conditional" 
> encryptNameIds="never"/>
> 
> handler.xml
>     <ph:ProfileHandler xsi:type="ph:SAML2ECP" 
> inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
> outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
>         <ph:RequestPath>/SAML2/SOAP/ECP</ph:RequestPath>
>     </ph:ProfileHandler>
> 
> 
> Is this not the right config?
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7327 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20121012/2a17c20f/attachment-0001.bin