Remote IdP not responding?

[Roger Jagoda]

Scott,

The local Metadata file works just fine:

  <MetadataProvider type="XML"
file="/etc/shibboleth/testdb.idp2.edu-metadata.xml"/>

Also makes things easier for this particular client since they are not
federated anywhere.

The only thing remaining is the Session initiation. We protect a page
on our side (SP) and trigger the Shibboleth session with the usual
vhost configuration:

<Location /secure/protected.php>
   AuthType shibboleth
   ShibRequireSession On
   require valid-user
   ShibUseHeaders On
</Location>


What is the best way of forcing the redirection to the appropriate
URL. In this case that is:

      https://shibboleth.testdb.idp2.edu/idp/profile/SAML2/Redirect/SSO

As you have discussed in the past, we're trying not to use
ApplicationOverride, and since we're maintaining the Metadata locally,
we cannot use an entityID:

            <SSO
entityID="https://shibboleth.testdb.idp2.edu/idp/profile/SAML2/Redirect/SSO">
              SAML2 SAML1
            </SSO>


Does that leave us with a SessionInitiator?

We've examined this page from the wiki:
    https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator#NativeSPSessionInitiator-TypesofSessionInitiators

Perhaps something like this:

          <SessionInitiator type="Chaining" Location="/Login"  id="idptest"
                relayState="cookie"

entityID="https://https://sso.brown.edu/idp/profile/SAML2/Redirect/SSO">
              <SessionInitiator type="SAML2" acsIndex="1"
                template="bindingTemplate.html"/>
              <SessionInitiator type="Shib1" acsIndex="5"/>
          </SessionInitiator>


A few details:

What does "/Login" refer to? Is it the local directory on the SP or
the suffix on the IdP URL?
If the former, should /Login be changed to /secure (see our vhost lines above)?

--RJ

====================================

Roger Jagoda
rberryj3 at gmail.com
==============================================


On Mon, Jul 1, 2013 at 1:41 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>> 1) They sent us the proper metadata file by encrypted mail. If we are
>> using SOLELY their metadata file, do we even need to have a
>> MetadataProvider URI specified?
>
> You *can't* have one specified in that event.
>
>> If so, where will Shibd want that file to be located? Our guess is
>> /etc/shibboleth but I don't see any documentation for that location.
>
> It's etc/shibboleth (look at all the other unqualified files in the configuration).
>
>> Does the actual fine name matter, or do we have control over that?
>
> That's up to you.
>
>> However, the Metadata file shows this for a SSO Redirect:
>
> That has nothing to do with the entityID, that's a location for an endpoint.
>
>> Should the SSO entityID then be this:
>
> Absolutely not.
>
>> For this to all work, should the local MetadataProvider stanza come
>> before any other of the other stanzas?
>
> Assuming you mean the XML elements in the file, most of the elements inside <ApplicationDefaults> can be in any order now.
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net