integration with Adobe Experience Manager

[Peter Schober]

* Liam Hoekenga <liamr at umich.edu> [2014-10-29 16:55]:
> Adobe's suggestion for the proper SingleLogoutService URL seems sketchy...
> <md:SingleLogoutService Binding=
> "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://www.blogsaml.com:8443/idp/Authn/UserPassword"/>
> 
> It's weird to me that the SP's metadata would define a SingleLogoutService
> with a URL pointing to a specific IdP.  Weirder yet that they would point
> to the authentication handler URL?

That's certainly nonsense, as the specific handler used for
authentication is private to the IDP, not exposed via SAML metadata.

Also the handler wouldn't be running on the back-channel port (8443),
so that also gives some indication as to the quality of that
documentation.

As for a vendor documenting how to create metadata that's only valid
for a single IDP, that doesn't surprise me much, as most of them have
SSO endpoints specific to a single IDP anyway (which prevents
federating that SP properly by including /one/ copy of that SP's
metadata in a federation aggregate).
-peter