open ports / version mismatch

[Brian Tingle]

________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Nate Klingenstein [ndk at internet2.edu]
Sent: Tuesday, June 11, 2013 6:25 PM
To: Shib Users
Subject: Re: open ports / version mismatch


> I guess if I had to grasp at a straw, I'd see if the SP's that the IdP is working with successfully are including a desired authentication method of
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport with their requests, as Eric alluded to, while your SP is not specifying a desired authentication method in its
> requests, and the IdP has both ph:RemoteUser and ph:UsernamePassword uncommented and using the default configuration.

He sent me his handlers.xml; your guess seems to be correct, as far as I can read this https://gist.github.com/tingletech/5767470


    <!-- Login Handlers -->
    <ph:LoginHandler xsi:type="ph:RemoteUser">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
    </ph:LoginHandler>

    <!-- Login handler that delegates the act of authentication to an external system. -->
    <!-- This login handler and the RemoteUser login handler will be merged in the next major release. -->
    <!--
    <ph:LoginHandler xsi:type="ph:ExternalAuthn">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
        <ph:QueryParam name="foo" value="bar" />
    </ph:LoginHandler>
    -->

    <!--  Username/password login handler -->

    <ph:LoginHandler xsi:type="ph:UsernamePassword"
                  jaasConfigurationLocation="file:///apps/shibboleth-idp/conf/login.config">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
    </ph:LoginHandler>


> If my straw is the correct one, the best fix in this case would probably be for the IdP to comment out the RemoteUser login handler.

I'm not sure I'm going to have any luck convincing him anything is wrong with this configuration since it works with other SPs he has tested with.  He can not provide me with any configuration information for these SPs that work with this IdP; and Scott suggested I should not change my SP to accommodate this IdP configuration.

Testing the SP with this IdP seems to be on some checklist as a pre-reqresite to them registering my SP metadata with InCommon.  Do you think testing with testshib.org is a good enough test?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130612/4e35421a/attachment.html