Shibboleth IDP Connected to OIOSAML.net dk.nita.saml20 Service Provider

[Andrewiski]

I thought I would share what I had to change in OIOSAML.net to get it to work
with Shibboleth.

In OIOSAML.net the metadata data has this line.

<q1:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"
AuthnRequestsSigned="true" WantAssertionsSigned="true">

Note the AuthnRequestSigned="true"  this is hard coded to the true value in
the source code but it does not sign the AuthnRequest  so should be false. 
I changed the source code so it returns false but you may need to edit the
metadata if you can't change the source code.

In OIOSAML.net web.config for the shibboleth IDP the attribute
omitAssertionSignatureCheck="true" for some reason the returned assertion
from shibboleth does not have a key maked as signing so the code can't
figure out which key to use to decode it.  I haven't dug into this further
to figure out what needs to be changed in dk.nita.saml20 source code but
will shortly.

thirdly the default web.config for dk.nita.saml20 has the NameIDFormat set
to 
<NameIdFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIdFormat>

when it needs to be
<NameIdFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIdFormat> 
else you won't get back a value in Subject which dk.nita.saml20 is hard
coded to expect so it will error out. 


I also had to modify the metadata I received from the Shibboleth IDP
provider to remove any unrecognized Bindings. Seems silly but when
dk.nita.saml20 source code hits a binding it doesn't recognize it throws an
error instead of just ignoring it.   

I left only urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST,
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect,
urn:oasis:names:tc:SAML:2.0:bindings:SOAP
and dk.nita.saml20  seemed to work correctly.


Hope this saves other days of research and testing in the future.

If only I could read Danish I would post this to there site in hopes they
will fix the source code but even after translating the pages I couldn't get
the forum registration process to create an account for me.

Andrew DeVries
andy at digitalexample.com




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-IDP-Connected-to-OIOSAML-net-dk-nita-saml20-Service-Provider-tp7604857.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.