Shibboleth and TMASystems

[Nickles, Brent]

Thanks for the reply Nate.    Perhaps I'm stating my issue incorrectly or I'm just not understanding.

We are expected to send the SAML response to a specific URL as in samlservice.aspx that will then consume the response.  From what I see in the documentation, the ACS URLs are virtual, not literal.  In our case, we are trying to send the response to a literal ACS URL.

For example instead of the ACS URL http://webtma.umaryland.edu/Shibboleth.sso/SAML2/POST, I need to send directly to http://webtma.umaryland.edu/tmalogin/samlservice.aspx?c=umb



From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: Friday, May 31, 2013 12:15 PM
To: Shib Users
Subject: Re: Shibboleth and TMASystems

I can't speak to #1, but #2 is what the software does by default if the metadata and AuthnRequest are written right.

e.g. from http://testshib.org/metadata/testshib-providers.xml

<AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sp.testshib.org/Shibboleth.sso/SAML2/POST"/>

and the AuthnRequest(note the AssertionConsumerServiceURL and the ProtocolBinding):

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO" ID="_1a29a54e828c6c52a6c1f86bff6fff7b" IssueInstant="2013-05-31T16:13:38Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><https://sp.testshib.org/shibboleth-sp%3c/saml:Issuer%3e><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>

If they know enough to make that request, I hope they know enough to formulate good metadata and AuthnRequests.

On May 31, 2013, at 16:06 , Nickles, Brent wrote:


2.       They support SAML but the only consume assertions to a specific location.   They are expecting us to send a SAML response via an HTTP-POST to specific location....how is this done?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130603/fb82095a/attachment.html