Shib SP ECP - a few woes

[Giovanni Bajo]

Il giorno 16/ott/2013, alle ore 03:13, "Cantor, Scott" <cantor.2 at osu.edu> ha scritto:

> On 10/15/13 6:38 PM, "Giovanni Bajo" <rasky at develer.com> wrote:
> 
>> 2) The response from my IdP does not include a SOAP:Header within
>> SOAP:Envelope. It only contains the SOAP:Body.
> 
> I don't think that can be a Shibboleth IdP then, or we have an unreported
> bug.

Sorry for not mentioning, it is in fact SimpleSAMLphp.

>> ecp.py was expecting the SOAP:Header to extract the ACS URL and compare
>> it with the one that was mentioned in the SP response, and error out if
>> those two URLs don't match.
> 
> That's mandatory behavior.
>> I've patched out this check. Is this a security issue? Isn't the
>> signature enough to validate the IdP response, without having to
>> double-check the consistency of the ACS URL?
> 
> No.

OK, I'll look for the bug on the other side then.

Thanks
-- 
Giovanni Bajo   ::  rasky at develer.com
Develer S.r.l.  ::  http://www.develer.com

My Blog: http://giovanni.bajo.it





-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4207 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20131016/00e04220/attachment.bin