Shibboleth and TMASystems

[Michael A Grady]

On Jun 3, 2013, at 7:10 AM, Nate Klingenstein wrote:
> 
>> For example instead of the ACS URL http://webtma.umaryland.edu/Shibboleth.sso/SAML2/POST, I need to send directly to http://webtma.umaryland.edu/tmalogin/samlservice.aspx?c=umb
> 
> Then that's the URL that should be in their metadata and in the AuthnRequest.  I believe the IdP will honor ACS URL's with query strings, but it's not a common use case, so this will be the first place to start looking should you have an issue.
> 

Yes, that form of ACS should be fine. I recently helped with an institution with an integration with SuccessFactors, and their (SuccessFactors) Assertion Consumer endpoint similarly contains a query argument. This involved IdP-initiated flow, so there wasn't an authentication request, but the Shib IdP was quite happy to package and send the response to that endpoint.

    <md:AssertionConsumerService xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://xxxxxx..successfactors.com/saml2/SAMLAssertionConsumer?company=NNNNNP" index="1"/>



--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130603/91d41a3c/attachment.html