vendor "has no metadata"

[Nate Klingenstein]

David,

That's a really unfortunate story.  You'll have to mock up metadata on behalf of that vendor and turn off encryption for that vendor because they have no certificate.  It'll look a lot like:

<EntityDescriptor entityID="https://vendor.com/sp" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

        <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://vendor.com/ACS" />
    </SPSSODescriptor>
</EntityDescriptor>

and

<RelyingParty id="https://vendor.com/sp"
        provider="YOUR-ENTITY-ID"
        defaultSigningCredentialRef="IdPCredential">
    <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
</RelyingParty>

I would continue to encourage the vendor to supply metadata even if you can demonstrate interoperability because hardwiring all this isn't a good or sustainable model.

Thanks,
Nate.

On Jan 24, 2014, at 12:26 PM, David Bantz <dabantz at alaska.edu>
 wrote:

> A vendor’s SAML SP "does not export SAML metadata” including not providing a certificate.
> That’s a first for me and I don’t understand how I can configure my IdP
> to provide appropriate SAML assertions about my users for that service.
> All prior integrations have relied on metadata with entity descriptions and certificates.
> 
> David Bantz
> UA IAM
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net