Shibboleth and ACS

[Sean Bergam]

Thanks, Scott.  Yes, I was referring Azure Access Control Service.  Sorry I wasn't aware of the acronym-clash.  :)



And yes, I have the appropriate metadata to add to it (wasn't planning on pulling it out of my ear).  And no, I wasn't under the impression that pointing my app to any server in the world would make it a web server.  :)



The question I wanted to ask is whether Azure ACS supports the SAML 2.0 protocol.  I recognize this not a Shibboleth specific question, but as ACS has gained some prevalence in the federated identity space and I am having issues integrating it with Shibboleth I thought I would ask here.



Does anyone have experience doing this?



-          Sean



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, February 13, 2014 10:36 AM
To: Shib Users
Subject: Re: Shibboleth and ACS



On 2/13/14, 11:59 AM, "Sean Bergam" <sbergam at truenorthlogic.com<mailto:sbergam at truenorthlogic.com>> wrote:



>I¹m trying to switch my SP to a new IdP.  Currently, I¹m integrated

>with a customer¹s ADFS server using Shibboleth, and SAML 2.0 POST

>binding.  I was thinking it would be dead simple to switch over to

>using ACS, so that I could federate with the existing IdP via the ACS

>console, and add other IdPs as well.



ACS here is Azure? ACS in SAML means AssertionConsumerService, so that has the potential to be confusing.



>However, when look at the metadata XML provided by my ACS namespace, it

>doesn¹t have an IDPSSODescriptor element so Shibboleth complains.  Does

>that mean that ACS doesn¹t support the SAML 2.0 protocol?



I have no idea.



>  I found an article

>here <http://msdn.microsoft.com/en-us/library/gg185948.aspx> from 2013

>saying that it does support it but it¹s in ³feature preview².  Any ideas?

> Can I just modify the XML to include the IDPSSODescriptor element?



Provided you have accurate information to put into it. You can't just make up metadata, it describes behavior that has to be present on the other side. You can point your browser at any server in the world, but that doesn't make every server a web server.



-- Scott





--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140213/603f55f9/attachment.html