Help configuring custom relying party for a relaystate url

[Ian Rifkin]

Scott,

I think I may have figured it out…I didn't include metadata for this SP,
but they are a member of InCommon and I do look at InCommon's metadata.

If it helps, the SP I'm talking about it https://dmp.cdlib.org -- I see
Ohio State is also on the list of institutions so maybe you can explain how
you set it up for them?

Is referring to the InCommon metadata and creating a filter policy enough?
It seems to work, but I want to make sure I'm doing things the right way.

Thanks,
Ian


On Tue, Aug 20, 2013 at 3:02 PM, Ian Rifkin <irifkin at brandeis.edu> wrote:

> Hi,
>
> Thanks so much for your responses…
>
> You should probably determine why you're mistaken. You do NOT have a
>> system that would ever respond to an SP without metadata provided, so your
>> impression that that works is incorrect.
>>
>
> Can you help me determine why I'm mistaken? If I go to the SP's URL and
> click to login I see that I'm taken to my shibboleth IdP and sent back to
> them and the vendor claims I'm logged in and is in possession of the
> attribute I released to them. I assumed that since I'm able to login that
> it's working…
>
> Then it wouldn't be released, but there is no evidence of who an SP is
>> without metadata, and that's the meaning of anonymous.
>>
>
> Do you mean that without metadata my configuration would work but that
> anyone could spoof being the SP and use the IdP to gain access to
> attributes? And if so how does creating a metadata file for them prevent
> that? Or do you mean something else?
>
> Sorry, I'm a bit new at using Shibboleth! I have it up and running, but
> don't fully understand all the intricacies yet. Some SP vendors are easier
> to work with than others!
>
> Thanks again,
> Ian
>



-- 
Ian Rifkin '04, MS '09
Software Systems Manager
Library and Technology Services (LTS)
Brandeis University

http://go.brandeis.edu/u:irifkin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130820/3db037c9/attachment.html