Another question concerning Ping

[Cantor, Scott]

On 8/29/14, 3:24 PM, "Brewer, Edward L" <lee.brewer at Vanderbilt.Edu> wrote:

>I have a vendor who is using Ping Federate and is having issue consuming
>my metadata for two reasons.  Firstly, there are references to SAML 1.1
>bindings (this is for my IdP) in one of my SSO Service entries.  I looked
>at the documentation (SAML 2.0 Metadata doc) and it appears that the
>binding attribute under SSO service should be of complex endpoint type
>which appears, as far as I can tell from the schema, only  needs to be a
>URI.  So I assume it is valid.

SAML metadata can express endpoints for any protocol it's profiled to
support. Consuming metadata requires allowing for many different bindings,
roles, protocols, endpoint types, etc, plus straight extensions. All of
that is explicit in the standard.

>Next, Ping seems to be looking for <SignatureValue> tag in metadata to
>pull out the signing certŠ in my case it is ds:X509Data.  Has anyone else
>seen this?

Somebody, likely not Ping but your vendor, is confusing the credentials
contained in metadata from the signature over it.

I don't know what metadata they're consuming, but providing metadata once
is mostly pointless, they can simply enter the information into Ping the
way it prefers. Metadata is for creating ongoing secure trust
relationships, which requires use of a signature, the validUntil
attribute, and proper constraints on the consuming end, none of which Ping
supports.

In a nutshell, if they're not using a set of tools to automate the secure
import of metadata on a daily basis into Ping, they're wasting their time
anyway and you don't have to bother creating an appropriate metadata
publishing strategy unless you're doing it for other reasons.

-- Scott