IDP-initiaded SSO or IdPUnsolicitedSSO

Peter Schober peter.schober at univie.ac.at
Wed Oct 16 10:34:43 EDT 2013


* Peter Schober <peter.schober at univie.ac.at> [2013-10-16 12:59]:
> So that it basically looks more something like this:
> 
> http://pastebin.com/TVbZjrSu

So, from all we've gathered so far, you'll need to to this:

Add the above metadata to your IdP (local metadata file, request
addition to your federation, whatever), as per
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPCommunicate

(You'll still need to fix any AssertionConsumerService lines in that
metadata, since they contain made-up values.)

Then set includeAttributeStatement="true" either for the
DefaultRelyingParty (ProfileConfiguration
xsi:type="saml:ShibbolethSSOProfile"), as per
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPShibSSOProfileConfig
Or (if you don't want to send unencrypted attributes to all your SAML1
SPs) create a custom RelyingParty configuration in your
relying-party.xml just for this SP and set it there only:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty

After all that you should be able to initiate a session with this SP
using the request protocol Scott pointed you to, something like:

https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp

Where I'm assuming in this example that:
* you want to end at the resource https:/test.travel.com after session
  establishment, otherwise adjust the "target" parameter accordingly,
* the entityID (providerId parameter) of the SP is
  https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp
* the AssertionConsumerService location (shire parameter) for the SP is
  https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp
  (you'll need to ask the SP for that).

Of course I have no idea if any of those assumptions are correct for
the SP in question.

Let us know what is still unclear (stating specifically what you did)
and how it went.
-peter


More information about the users mailing list