EPPN attribute

[Peter Schober]

* Josef Fortier <fortier at augsburg.edu> [2014-01-27 21:55]:
> > The reason for this to happen would be when the SAML metadata the SP
> > has for your IDP is missing a Scope metadata extension (or the value
> > of that element does not match what you're sending; unlikely in this
> > case).
> 
> Can you offer any suggestions about wording to pass on to help our
> vendor, I'm thinking mostly along the right place to look in a
> Shibboleth IIS SP setup.

The SP is setup correctly. It's the metadata the SP has on record
(that you gave to the SP) for your IDP that is missing something.

So it's a question of how you and the SP exchange metadata.

Assuming you pointed the SP to the URL on your IDP that produces SAML
(XML) metadata, you'd need to change SSP's configuration to also
produce the Scope element in that output. Not a question for this list
but  just add "scope" to your ./metadata/saml20-idp-hosted.php:
http://simplesamlphp.org/docs/stable/simplesamlphp-reference-idp-hosted#section_1

(Of course semantically an IdP self-asserting what scopes it is
allowed to assert is laughable but whatever.)

If you're not using SimpleSAMLphp's metadata generator then you'd have
to add the missing XML manually to whatever you give to the SP.
Try the above method to see the result.

> > I can't find your IDP in InCommon metadata...
> 
> Yeah, we should be there, but we're not. I'll probably end up
> setting up Shibboleth, as SSP doesn't support all the needed
> attributes for inCommon federation. But that will wait a bit.

I'm pretty sure you can use SSP successfully in InCommon, but that's
not a topic for this list, of course.
-peter