"SAML 2.0 Compliant"?

[David Langenberg]

We ask that exact question a lot as it tends to get more "yes" answers out
of vendors who may support SAML but for some odd reason have never heard of
Shibboleth.  As your an SP, I wouldn't read too deeply into the question.
 Tell them you're running the Shibboleth SP 2.5 and inquire about what type
of IdP they're trying to bring to the table.  After that, then worry about
profiles and bindings.

Dave


On Tue, May 28, 2013 at 2:52 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 5/28/13 4:38 PM, "MikeWho" <who at me.com> wrote:
>
> >During an integration discussion with a client, we were asked if our
> >application (i.e. site) is "SAML 2.0 compliant". Is there a specific
> >definition of/criteria for this? Do all 2.0 bindings need to be supported,
> >or just any one?
>
> There is nothing in SAML conformance that addresses *deployments*, so this
> isn't a valid question, though it is a common one. What people usually
> mean is whether you have a deployment that uses an implementation of SAML
> that is itself generally conformant and won't be riddled with limitations.
> But you can use a conformant product and just pick all the worst options
> or impose the worst approaches, and it will be just as bad (not that you
> are, just making a point).
>
> The closest thing to a vanilla *deployment* profile that we have is
> saml2int (see saml2int.org). That is something a deployment can claim to
> support and addresses your other question, I think.
>
> >Instead of a yes/no answer, I guess I'll have to go with "well, we are
> >using
> >Shibboleth 2.5 SP to implement SP initiated SSO with HTTP Redirect
> >binding;
> >and support just-in-time user provisioning." But I don't know if that's a
> >yes, no or maybe.
>
> That's pretty much a yes, but note that you described there the outgoing
> binding (SP to IdP) and not the inbound one.
>
> But it's often an implication, for example, that you're handling metadata
> "well", by virtue of using the only implementation in the world that does.
> In large respect, that fact alone is more important than most of the other
> SAML requirements you could try and enumerate, and it isn't captured
> anywhere in SAML 2.0's original, long outdated, conformance material.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130528/0dc28332/attachment.html