SAML2ECP profile is not configured for relying party 'urn:federation:MicrosoftOnline'

[Ryan Suarez]

Thanks Ryan, this worked for us.

cheers,
Ryan

On 12-10-12 11:10 AM, Ryan Larscheidt wrote:
> This relying party configuration works for us:
>
>      <rp:RelyingParty id="urn:federation:MicrosoftOnline"
>                    provider="${entityid}"
>                    defaultSigningCredentialRef="IdPCredential">
>          <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" signAssertions="conditional" encryptAssertions="never" encryptNameIds="never" />
>          <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" signAssertions="conditional" encryptAssertions="never" encryptNameIds="never" />
>      </rp:RelyingParty>
>
> Thanks,
> Ryan
>
> On Oct 12, 2012, at 09:36 , Ryan Suarez <ryan.suarez at sheridanc.on.ca> wrote:
>
>> On 12-10-12 10:11 AM, Cantor, Scott wrote:
>>> You apparently created a dedicated RelyingParty definition and it doesn't
>>> contain the ECP profile config element in relying-party.xml.
>>> Alternatively, if it's using the DefaultRelyingParty element, the profile
>>> isn't there either.
>>>
>>> It was added, I believe, to the default file in newer versions, but it
>>> can't be there if you upgraded and didn't add it.
>> Right.  Upgraded the IdP (to v2.3.6) and had to manually add all the ECP
>> bits, which I copied from a clean install of v2.3.8:
>>
>> relying-party.xml
>>          <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
>> includeAttributeStatement="true"
>>                                   assertionLifetime="PT5M"
>> assertionProxyCount="0"
>>                                   signResponses="never"
>> signAssertions="always"
>>                                   encryptAssertions="conditional"
>> encryptNameIds="never"/>
>>
>> handler.xml
>>      <ph:ProfileHandler xsi:type="ph:SAML2ECP"
>> inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
>> outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
>>          <ph:RequestPath>/SAML2/SOAP/ECP</ph:RequestPath>
>>      </ph:ProfileHandler>
>>
>>
>> Is this not the right config?
>>
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


-- 
Ryan Suarez
System Administrator - IT
Sheridan College
1430 Trafalgar Road
Oakville, ON
L6H 2L1
905.845.9430 x2146

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121017/28631a58/attachment-0001.html