SP stopped working after IDP upgraded to 3.1.1

[Hong Ye]

Hi Scott,

The vendor said they can’t remove RequestedAuthnContext. They changed the comparison to “exact”. It still not working. Do I have to configure something in IDP 3 to support “exact’ comparison? Where is the document for comparison rule? Thanks!

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    ID="s2cc810bf3bae5be9024f609b3dca492eac75f88ac"
                    Version="2.0"
                    IssueInstant="2015-04-13T16:16:24Z"
                    Destination="https://shibidp-test.cit.cornell.edu/idp/profile/SAML2/Redirect/SSO"
                    ForceAuthn="false"
                    IsPassive="false"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    AssertionConsumerServiceURL="https://login-ma-sso.onbmc.com:443/atriumsso/Consumer/metaAlias/cornell-dev/sp"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">sp</saml:Issuer>
    <samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                        AllowCreate="true"
                        />
    <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                                 Comparison="exact"
                                 >
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

Hong
On Apr 7, 2015, at 11:57 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/7/15, 10:56 AM, "Hong Ye" <hy93 at cornell.edu> wrote:
> 
>> Hi Scott,
>> 
>> Thanks for your reply. I was running v2.4.3 before.
> 
> Well, 2.x doesn't support comparison operators like "minimum". What surprises me is that all it does is emit a warning, which I would say is a bug, but that's academic after years of it operating that way. Even so, if you run an IdP and ignore warnings, you're going to end up with a problem, and now you have one.
> 
> 3.x does support non-exact comparison rules, but it doens't support them unless it's taught how to do that.
> 
> That's documented, more or less, but in this case what that SP is doing is wrong and it should stop. What it's asking for is nonsensical.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net