Testing SAML2 Support

[Cantor, Scott]

On 8/6/15, 4:12 PM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:


>
>I believe you're right here. Thanks for pointing that out, I do see the line a couple times which would be consistent with metadata sources. I don't suppose it's possible to have Shibboleth specify which metadata store it is referring to in those type of errors?

I assumed it did. It should.

>Anyway, taking a fresh look at the log with what you've noted in mind, I notice a line mentioning, in part, "...Metadata document does not contain a role of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol urn:oasis:names:tc:SAML:2.0:protocol
> for entity..." I'm suspecting that means that this SP does not publish SAML2 support in their metadata, and Shibboleth is essentially saying that it can't find SAML2 metadata to use to handle the request?

I would assume so. If that's the one you're talking about, that would throw the unregistered error.

>Good to know. I'll have to get my line of questioning in order on that though. I'm guessing it will largely consist of asking them what their logs show and working something out from there?

I can't really put myself in the shoes of somebody that doesn't have a fairly deep insight into what the problem is already. When I did this, I generally knew roughly what they had screwed up and I was basically telling them what to fix.

I wasn't 100% right. A couple of cases turned out to legitmately be casued by cookie issues that essentially meant I couldn't do IdP-initiated SSO and so there was no way to test it.

In the absence of that experience, it's not going to be an easy road to get them to understand there might be a problem, but if all you have to go on is some generic error, that's about all you can do.

If the SP is Shibboleth, there's a decent chance I can guess what it's doing wrong if that's what you're running into. But mostly the issues are with cross-protocol attribute mapping in pretty much any implementation.

I ran into one that refused to support mappings of both protocols at the same time and required a flag day to change. I reported the problem to my customer and let them either pressure the vendor or live with an outage when the time came.

-- Scott