IDPv3 and ECP

[Edwards, Wendy A]

To set up ECP on Shib IDP v2 with basic authentication, it looks like I’d
do something like the following:
Edit conf/relying-party.xml to include these lines:

<rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
                              signAssertions="always"
                              includeAttributeStatement="true"/>


Edit conf/handler.xml to include these lines:

<ph:ProfileHandler xsi:type="ph:SAML2ECP"
        inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
        
outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
      <ph:RequestPath>/SAML2/SOAP/ECP</ph:RequestPath>
    </ph:ProfileHandler>


Protect the endpoint /idp/profile/SAML2/SOAP/ECP using my Apache
configuration.

In IDP v 3.1, it looks like conf/handler.xml has been replaced by the
conf/authn/ files, with RemoteUserInternalAuthnConfiguration being the
recommended approach for ECP.  Would the syntax I’d be looking for with
relying-party.xml in V3 look something like

<bean parent="OurSPName" c:relyingPartyIds="https://our.sp.name.here">
            <property name="profileConfigurations">
                <list>
                    <bean class="SAML2.ECP"/>
                </list>
            </property>
        </bean>

In idp.properties, do I just set idp.authn.flows=RemoteUserInternal






On 4/13/15, 5:56 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:

>OK, thanks, Scott.  I’ll try that.
>
>On 4/13/15, 5:53 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>>On 4/13/15, 9:15 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:
>>
>>
>>>
>>>We¹re actually using Apache Tomcat, not Jetty.
>>
>>Ok.
>>
>>>Below are some excerpts from the shib logs.  It looks like whatever is
>>>coming back doesn¹t make sense to the XML parser (seems like this might
>>>be
>>>the case with a SOAP error).
>>
>>There's nothing coming back, your SOAP submission to the IdP isn't valid.
>>I can't really debug that for you, but that's the problem.
>>
>>My advice is that you go back to basic-auth and get that working. At that
>>point, you know the rest is up to Apache and your client.
>>
>>Beyond that you'd have to start logging traffic I guess.
>>
>>-- Scott
>>
>>-- 
>>To unsubscribe from this list send an email to
>>users-unsubscribe at shibboleth.net
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net