"SAML 2.0 Compliant"?

[Cantor, Scott]

On 5/28/13 4:38 PM, "MikeWho" <who at me.com> wrote:

>During an integration discussion with a client, we were asked if our
>application (i.e. site) is "SAML 2.0 compliant". Is there a specific
>definition of/criteria for this? Do all 2.0 bindings need to be supported,
>or just any one?

There is nothing in SAML conformance that addresses *deployments*, so this
isn't a valid question, though it is a common one. What people usually
mean is whether you have a deployment that uses an implementation of SAML
that is itself generally conformant and won't be riddled with limitations.
But you can use a conformant product and just pick all the worst options
or impose the worst approaches, and it will be just as bad (not that you
are, just making a point).

The closest thing to a vanilla *deployment* profile that we have is
saml2int (see saml2int.org). That is something a deployment can claim to
support and addresses your other question, I think.

>Instead of a yes/no answer, I guess I'll have to go with "well, we are
>using
>Shibboleth 2.5 SP to implement SP initiated SSO with HTTP Redirect
>binding;
>and support just-in-time user provisioning." But I don't know if that's a
>yes, no or maybe.

That's pretty much a yes, but note that you described there the outgoing
binding (SP to IdP) and not the inbound one.

But it's often an implication, for example, that you're handling metadata
"well", by virtue of using the only implementation in the world that does.
In large respect, that fact alone is more important than most of the other
SAML requirements you could try and enumerate, and it isn't captured
anywhere in SAML 2.0's original, long outdated, conformance material.

-- Scott