IDP-initiaded SSO or IdPUnsolicitedSSO

[Jehan Procaccia]

Le 16/10/2013 16:34, Peter Schober a écrit :
> * Peter Schober <peter.schober at univie.ac.at> [2013-10-16 12:59]:
>> So that it basically looks more something like this:
>>
>> http://pastebin.com/TVbZjrSu
> So, from all we've gathered so far, you'll need to to this:
>
> Add the above metadata to your IdP (local metadata file, request
> addition to your federation, whatever), as per
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPCommunicate
>
> (You'll still need to fix any AssertionConsumerService lines in that
> metadata, since they contain made-up values.)
OK I added the metadata in my IDP relying-party.xml as you provided in 
http://pastebin.com/TVbZjrSu, leaving the ACS lines as you fix them, as 
I don't have other better clue .

<MetadataProvider id="ShibbolethMetadata" 
xsi:type="ChainingMetadataProvider" 
xmlns="urn:mace:shibboleth:2.0:metadata">
  <!-- fed-sp-ext test travel -->
         <MetadataProvider id="fedeIMText" 
xsi:type="FileBackedHTTPMetadataProvider" 
xmlns="urn:mace:shibboleth:2.0:metadata"
                 
metadataURL="http://shibidp1.int-evry.fr/metadata/fed-sp-ext.xml"
                 backingFile="/opt/shibboleth-idp/metadata/fed-sp-ext.xml">
        </MetadataProvider>

>
> Then set includeAttributeStatement="true" either for the
> DefaultRelyingParty (ProfileConfiguration
> xsi:type="saml:ShibbolethSSOProfile"), as per
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPShibSSOProfileConfig
> Or (if you don't want to send unencrypted attributes to all your SAML1
> SPs) create a custom RelyingParty configuration in your
> relying-party.xml just for this SP and set it there only:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty
default includeAttributeStatement  was already fixed to true in my 
relaying-party.xml file :

<DefaultRelyingParty provider="https://idp.int-evry.fr/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">
<ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile"
*includeAttributeStatement="true"*
                               assertionLifetime="300000"
                               signResponses="conditional"
                               signAssertions="never" />

...
<ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
*  includeAttributeStatement="true"*
                               assertionProxyCount="0"
                               signResponses="conditional"
                               signAssertions="always"
                               encryptAssertions="conditional"
                               encryptNameIds="conditional" />

>
> After all that you should be able to initiate a session with this SP
> using the request protocol Scott pointed you to, something like:
>
> https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp
Yes, calling that URL from my browser
https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp
does return me to our IDP SSO login page and finally ends at their SP ;-)

My IDP logs while accessing the above URL are :

17:25:38.676 - INFO [Shibboleth-Access:73] - 
20131016T152538Z|157.159.21.185|idp.int-evry.fr:443|/profile/Shibboleth/SSO|
17:25:54.320 - INFO [Shibboleth-Access:73] - 
20131016T152554Z|157.159.21.185|idp.int-evry.fr:443|/profile/Shibboleth/SSO|
17:25:54.402 - INFO [Shibboleth-Audit:745] - 
20131016T152554Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp|urn:mace:shibboleth:2.0:profiles:saml1:sso|https://idp.int-evry.fr/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_5ec2804f8603ecfee1041bbc4c931b17|procacci|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|supannEtablissement,transientId,email,|_9a020512fbe201ef30d82a24da0dea2c|_338263ad9f732730c9ccca08d4372a14,|

looks good so far .

then on their site it fails to login, but it might be because I didn't 
sent them a correct value of attribute for login name
They told me that they created an account for me  with the ID of my 
email address, I must figure out now a way to send my email as the 
username for that SP ...
I will check my IDP attribute-resolver.xml and attribute-filter.xml to 
fix that ,
do you confirm that it is  the correct next step ?

Thanks a lot .

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131016/6f9c4b15/attachment-0001.html