ACS endpoint: Can I intercept the assertion?

[Alexey]

There is some information system - service provider (SP1), which is
registered in the identity provider (IdP). Information system works and must
be implemented SP-initiating Web-SSO scenario.

Service provider SP1: Java Web application that is available in the
Internet.
Identity provider: IdP, written on the basis of Shibboleth (Remote; access
to it I do not have).

IdP generates signed metadata for SP1.

To implement the SP-initiating Web-SSO scenario I wrote simple service
provider (SP2) on the basis of  OIOSAML
<https://svn.softwareborsen.dk/oiosaml.java/sp/trunk/webapp/>  .

What exactly do I need - is to check *AuthnResponse* from IdP. For this, I
want to specify endpoint of SP2 in attribute *Location* of the element
*AssertionConsumerService* of the metadata of SP1, but it does not work:

<md:EntityDescriptor 
      xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"          
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
      xmlns:esia="urn:esia:shibboleth:2.0:mdext"
entityID="http://domain-name-of-SP1-here.domain-zone-here">
...
<md:SingleLogoutService 
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"  
     
Location="http://domain-name-of-SP1-here.domain-zone-here/saml/consumer" 
     
ResponseLocation="http://domain-name-of-SP1-here.domain-zone-here/saml/consumer"/>
<md:AssertionConsumerService 
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
      Location="http://IP-of-SP2-here:8080/saml/consumer" 
      index="0" 
      isDefault="true"/>

In this configuration works: 

<md:EntityDescriptor 
      xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"          
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
      xmlns:esia="urn:esia:shibboleth:2.0:mdext"
entityID="http://domain-name-of-SP1-here.domain-zone-here">
...
<md:SingleLogoutService 
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"  
     
Location="http://domain-name-of-SP1-here.domain-zone-here/saml/consumer" 
     
ResponseLocation="http://domain-name-of-SP1-here.domain-zone-here/saml/consumer"/>
<md:AssertionConsumerService 
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
     
Location="http://domain-name-of-SP1-here.domain-zone-here/saml/consumer" 
      index="0" 
      isDefault="true"/>

And in sniffer (or using Firebug) I can see *AuthnResponse* (with error
*Unable to encrypt assertion*).

But this is not what I need. I would like to use my own SP2 and metadata of
SP1.

*Certificate X.509 v 3* of SP1 I have.

I would be very grateful for the information. Thanks to all.



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/ACS-endpoint-Can-I-intercept-the-assertion-tp7603636.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.