IDP-initiaded SSO or IdPUnsolicitedSSO

[Jehan Procaccia]

Le 16/10/2013 11:50, Peter Schober a écrit :
> * Jehan Procaccia <Jehan.Procaccia at it-sudparis.eu> [2013-10-16 11:15]:
>> org.opensaml.ws.message.decoder.MessageDecodingException: SAML 2
>> SPSSODescriptor could not be resolved from metadata for SP entityID:
>> https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp
> What does the metadata for that SP look like?
> (You do have metadata for that SP on record, right?)
As they don't run a shibboleth SP (nor a simplesamlphp or whatever else 
..) they didn't provide me any metadata :-(
So I "figured out" some myself for them !
I took some as a template from a traditional 2.5 shib SP and changed 
entidyID , SSL certificate (taken from their https site), and URL in 
bindings reflecting their site name
you can have a look a it at
http://shibidp1.int-evry.fr/metadata/fed-sp-ext.xml
it is the first 
entityID="https://test.travel.com/travelsite/externalauthenticateimt.jsp"
I must admit that it is challenging to figure out metadata for someone 
else SP , and I might have guess wrong .

But their "IDP initiaded" solution does work with their other clients 
...so I would like to make it work with a shibboleth IDP .

here's their workflow specifications (which I deducted to be a 
IDP-initiaded workflow)

1 .The user authenticates to the Identity Provider.
2. The user requests access to the site Travel Enterprise by clicking 
on a link on the intranet
3 . The Identity provider builds the SAML authentication message 
incorporating the unique identifier shared by Travel and the Identity 
Provider of the customer
4 . Travel servers identify the user
5 . The user accesses its Travel environment.

They told me that they are expecting a SAML reponse as that:

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" 
MajorVersion="1" MinorVersion="1" 
ResponseID="a75adf55-01d7-40cc-929f-dbd8372ebdfc" 
Recipient="*https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp*" 
IssueInstant="2013-10-09T08:55:00Z">
<samlp:Status>
<samlp:StatusCode Value="samlp:Success"/>
</samlp:Status>
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" 
MajorVersion="1" MinorVersion="1"
...

If their SP receives that kind of response, then our user should access 
their site.
If that workflow is compatible with shibboleth, then how can I create 
correct Metadata to feed my IDP with to make it work !?

> If so does it claim SAML2 support e.g. in the
> SPSSODescriptor/@protocolSupportEnumeration and
> AssertionConsumerService/@Binding attributes?
No, according to their SAML reponse massage sample, it supports only 
SAML 1.1
>> then is there a SAML 1.x IDP Unsolicited/SSO config sample ?
> I would guess having correct metadata for that SP alone would suffice.
yes, again, how to create them if they don't provide me metadata for 
their SP  ?

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131016/b373fee3/attachment-0001.html