Testing SAML2 Support

[Cantor, Scott]

On 8/7/15, 9:19 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users- <mailto:users-bounces at shibboleth.net>


>
>That in mind, my original plan had been to remove SAML1 and place in SAML2. Is it out of the question to simply add the remaining SAML2 portions to our published metadata while leaving all SAML1 support in place?

Yes, but any SP that auto-switches to SAML 2 and then has a problem is going to break. That's where we started this conversation.

> Most vendors have worked with SAML2 using this form of testing, and the only 2 that have completely bombed out have either not supported SAML2 at all or have another obscure error. 

Just saying that at least the latter one may well break when you do this, so that's a decision you'll have to make. The former may also break if they're configured improperly.

>(The latter of which I've initiated contact with the vendor about.) It seems like with the latter case solved, that the ones requiring SAML1 will just continue to work provided all that support is retained, assuming I have the correct idea here?

There are broken SPs that don't have SAML 2 support advertised, but use configurations that will switch protocols and start issing 2.0 requests to the IdP, at which point the IdP will break when it can't find the metadata needed to respond.

For a Shibboleth SP, you can be almost certain that if it doesn't advertise SAML 2 support, you're going to have a problem. It will change protocols as soon as you change your metadata, and then it will break.

>Hmm, so it seems like there's a legitimate chance that you can only go so far with testing, some of it will just need to be attempted in a production capacity?

Not for me, but I know how to determine what they're all going to do to within a high degree of accuracy.

>That said it seems that most of these SPs are Shibboleth, so hopefully they'll be open to suggestions of fixes.

Some of my worst vendors run Shibboleth, often that's a sign they were forced into doing something and just grabbed it as the path of least resistance. The only real advantage, for people who know the SP, is that you can tell them explicitly what to fix and be pretty accurate in guessing behavior.

-- Scott