IDP-initiaded SSO or IdPUnsolicitedSSO

[Jehan Procaccia]

Hello,

One of our new Service Provider tels us that he is SAML 1.0 SSO 
compatible, but isn't implementing a shibboleth SP.
It's SSO workflow is IDP initiaded, which if I understood well , in the 
shibboleth terminology means IdPUnsolicitedSSO 
<https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO> :
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO
So I configured my shibboleth IDP (2.4.0) according to the above 
specification with the example of  SAML 2.0 provided as there's no 
sample config for SAML 1.x and I can't figure out one (a sample config 
would be greatly appreciated !)
Unfortunatly , using that configuration, when  from a browser I directly 
request the IDP for that unsolicited SSO:
https://idp.int-evry.fr/idp/profile/SAML2/Unsolicited/SSO?*providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp*

it fails :

10:17:11.155 - INFO [Shibboleth-Access:73] - 
20131016T081711Z|157.159.21.185|idp.int-evry.fr:443|/profile/SAML2/Unsolicited/SSO|
10:17:11.157 - WARN 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400] 
- Error decoding authentication request message
org.opensaml.ws.message.decoder.MessageDecodingException: SAML 2 
SPSSODescriptor could not be resolved from metadata for SP entityID: 
https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp
     at 
edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSODecoder.lookupACSURL(UnsolicitedSSODecoder.java:256) 
~[shibboleth-identityprovider-2.4.0.jar:na]
     at 
edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSODecoder.doDecode(UnsolicitedSSODecoder.java:170) 
~[shibboleth-identityprovider-2.4.0.jar:na]
     at 
org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79) 
~[openws-1.5.0.jar:na]
...

I suspect that it is because I declared SAML 2.0 config Unsolicited/SSO 
but talk to  a SAML 1.0 SP ...

Is shibboleth 2.4.0 IDP able to work this way (IDP initiaded) with a 
SAML 1.0 SP ?
then is there a SAML 1.x IDP Unsolicited/SSO config sample ?
Do I have to add metadata for that SP in my federation ?

thanks for you help .


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131016/21d77f98/attachment.html