IDP-initiaded SSO or IdPUnsolicitedSSO

[Jehan Procaccia]

Le 16/10/2013 18:02, Peter Schober a écrit :
> * Jehan Procaccia <Jehan.Procaccia at it-sudparis.eu> [2013-10-16 17:49]:
>> 17:25:54.402 - INFO [Shibboleth-Audit:745] - 20131016T152554Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp|urn:mace:shibboleth:2.0:profiles:saml1:sso|https://idp.int-evry.fr/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_5ec2804f8603ecfee1041bbc4c931b17|procacci|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|supannEtablissement,transientId,email,|_9a020512fbe201ef30d82a24da0dea2c|_338263ad9f732730c9ccca08d4372a14,|
>>
>> looks good so far .
> At least your IdP happily sent the data where we said it should (not
> knowing whether that's correct in the first place). You really should
> ask the SP about the Location where to send assertions and where the
> email address should go, and in what format (see below).
>
>> then on their site it fails to login, but it might be because I
>> didn't sent them a correct value of attribute for login name
>> They told me that they created an account for me  with the ID of my
>> email address, I must figure out now a way to send my email as the
>> username for that SP ...
> According to your IdP audit log you're already releasing a form of
> email address as a SAML attribute.
> So either
> - they did not process your assertion correctly at all, or
> - the attribute name and nameFormat did not match what they expect, or
> - they expect email to be sent as a NameID, not as an attribute.
>
> While you could spend some time trying to figure all of this out
> yourself empirically you really should ask the vendor about all of
> this.
> -peter
you are right, I just sent the vendor these questions .
for now I create from attribute-resolver my email attribute this way

<resolver:AttributeDefinition id="email" xsi:type="Simple" 
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
         sourceAttributeID="mail">
         <resolver:Dependency ref="ldapTMSP" />
         <resolver:AttributeEncoder xsi:type="SAML1String" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
             name="urn:mace:dir:attribute-def:mail" />
         <resolver:AttributeEncoder xsi:type="SAML2String" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
             name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
     </resolver:AttributeDefinition>

So if I understood well, that attribute name is "email" (not mail right !?)
it's nameFormat is either SAML1String or SAML2String
and it's not a NameID .

If I want it to become a NameID it must be of type 
xsi:type="SAML2StringNameID" , but is it possible to sent multiple 
NameID attributes, my IDP already sends
AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID"

Back to the subject of this thread , as I finally point my browser to
https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target.....

Does this mean that my initial shoot at Unsolicited/SSO :
https://idp.int-evry.fr/idp/profile/SAML2/Unsolicited/SSO?....
isn't used anymore ? the Unsolicited/SSO I created in handler.xml isn't 
necessary !?

Thanks for helping me cleaning up my current config .