Problems linking to a shib protected image server

[Scott Koranda]

On Fri, Jan 17, 2014 at 1:54 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/17/14, 2:46 PM, "Scott Koranda" <skoranda at gmail.com> wrote:
> >
> >One can help mitigate the issue by configuring the SP serving the
> >protected images to prefer the artifact resolution profile.
>
> But how does the initial (or a timed-out) login happen? Or are you
> assuming the original wiki page with the links is also authenticated? I
> may have missed that assumption in the OP' note.
>
>
Yes, the original wiki page with the links is also authenticated/protected
using
a SAML (Shibboleth) SP.

I assumed because I happen to know the OP's use case, sorry.

It all "works" because one can, using the "old style" configuration for the
SP,
configure the SP to try to initiate a session using artifact resolution
first if the IdP metadata
indicates the IdP supports it. If the metadata indicates the IdP does not
support artifact
then the SP defaults to the other profiles.

The problem comes when an IdP advertises it supports artifact resolution
but it does not.
That happens more often than I would have thought.

Thanks,

Scott K for LIGO
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140117/b6f62707/attachment.html