Help configuring custom relying party for a relaystate url

[Ian Rifkin]

Hi,

Thanks so much for your responses…

You should probably determine why you're mistaken. You do NOT have a
> system that would ever respond to an SP without metadata provided, so your
> impression that that works is incorrect.
>

Can you help me determine why I'm mistaken? If I go to the SP's URL and
click to login I see that I'm taken to my shibboleth IdP and sent back to
them and the vendor claims I'm logged in and is in possession of the
attribute I released to them. I assumed that since I'm able to login that
it's working…

Then it wouldn't be released, but there is no evidence of who an SP is
> without metadata, and that's the meaning of anonymous.
>

Do you mean that without metadata my configuration would work but that
anyone could spoof being the SP and use the IdP to gain access to
attributes? And if so how does creating a metadata file for them prevent
that? Or do you mean something else?

Sorry, I'm a bit new at using Shibboleth! I have it up and running, but
don't fully understand all the intricacies yet. Some SP vendors are easier
to work with than others!

Thanks again,
Ian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130820/84b7e9bf/attachment.html