Shibboleth and ACS

[Sean Bergam]

Thank you, Scott.  I can see how people might get that perception.  Certainly no offense taken!  :)

My thought (hope?) was that the Azure ACS IdP actually did support the SAML 2.0 SSO protocol, but failed to advertise it in their metadata.  If so, I was considering modifying their metadata before importing to Shibboleth so that Shibboleth would know how to hook up.  I have the data (cert keys, etc.) for what I *think* they support, I guess now all that's left is to go try it.  Thanks!

- Sean

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, February 13, 2014 12:45 PM
To: Shib Users
Subject: Re: Shibboleth and ACS

On 2/13/14, 2:38 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>On Thu, Feb 13, 2014 at 2:10 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> ... some people seem to be under the misimpression that what you put 
>> in the metadata at an SP somehow causes an IdP to do something, or 
>> support something.
>
>Uh, I'm one of those people. I always thought that what I put in SP 
>metadata *did* in fact affect the behavior of the IdP. In fact, I can 
>put a certificate in my metadata that will cause *nearly every* IdP to 
>send an encrypted assertion that can't be decrypted.

And you misread me. I said "put in metadata *at* the SP", not "put in metadata about the SP".

That is, describing the IdP to the SP does not in and of itelf cause the IdP to behave in accordance with that description. People very, very often think that they "configure" an IdP or SP that way, rather than describing the configuration they already applied in the metadata afterwards.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net