question about IdP initiated SSO

[Joy Veronneau]

Hi,

Thanks for all the tips. I can see that the InCommon metadata for them doesn't have the issue so I am trying to find out why they are using AuthnRequestsSigned="true" in test.

Thanks again.

Joy

On Jul 26, 2013, at 1:54 PM, Mark K. Miller <max at psu.edu> wrote:

> 
> Hi Joy,
> 
> What metadata are you using for Skillsoft that mentions 
> AuthnRequestsSigned="true"?
> 
> Several months ago, Penn State convinced them to join InCommon and 
> register their metadata there (entityID="https://sso.skillport.com"). 
> That's the metadata I use for them, and I didn't seee the issue you're 
> describing.
> 
> Hope that helps,
> 
> Max
> 
> On Fri, 26 Jul 2013, Joy Veronneau wrote:
> 
>> Hi,
>> I am working on configuring our IdP (v 2.3.3) with Skillsoft. We want to use
>> IdP initiated SSO, and we also use IdP initiated SSO for some other vendors
>> (WebEx and WorkDay among them.)
>> 
>> My question centers around using 
>> AuthnRequestsSigned="true"
>> 
>> in the Skillsoft SP metadata. If I set this to false, then everything works.
>> If I set it to true, as they would like it set, then I get this error on the
>> IdP:
>> 
>> 11:37:28.033 - ERROR
>> [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:87] -
>> SPSSODescriptor for entity ID 'https://sso.skillport.com' indicates
>> AuthnRequests must be signed, but inbound message was not signed
>> 11:37:28.038 - WARN[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:34
>> 8] - Message did not meet security requirements
>> org.opensaml.ws.security.SecurityPolicyException: Inbound AuthnRequest was
>> required to be signed but was not
>> 
>> Is there a way to configure IdP initiated SSO for AuthnRequestsSigned="true"
>> without breaking our other IdP initiated SSO implementations?
>> 
>> Thanks,
>> 
>> Joy
>> 
>> 
>> 
>> 
>> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>