Repeated Login with Shib (idp) and ADFS (sp)

[Thomas Jones]

One more thing. In the integration process I didn't create a specific
relying party configuration for this SP, but instead consume their
metadata.

In their metadata they include the next info:

....
<SPSSODescriptor WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<KeyDescriptor use="encryption">
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<X509Data>
<X509Certificate>
MII...
</X509Certificate>
</X509Data>
</KeyInfo>
</KeyDescriptor>
<KeyDescriptor use="signing">
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<X509Data>
<X509Certificate>
MII...
</X509Certificate>
</X509Data>
</KeyInfo>
</KeyDescriptor>
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://adfs.domain/adfs/ls/"/>
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://adfs.domain/adfs/ls/"/>
<NameIDFormat>
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
</NameIDFormat>
<NameIDFormat>
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
</NameIDFormat>
<NameIDFormat>
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
</NameIDFormat>
<AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://adfs.domain/adfs/ls/" index="0" isDefault="true"/>
<AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="
https://adfs.domain/adfs/ls/" index="1"/>
<AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://adfs.domain/adfs/ls/" index="2"/>
</SPSSODescriptor>
....


So I'm guessing I'm not using their correct AssertionConsumerService
(either POST or redirect) but instead I'm using an endpoint that only
understand WS-Federation, right?

Another question: Why after the Ws-Federation URL is resolved and the
end-user reauthenticates, the process is correctly done, I mean the
AssertionConsumerService is displayed in the URL address bar and the
end-user is send to the Sp's app?

Best,






On Thu, Jan 22, 2015 at 10:27 AM, Thomas Jones <thomas.jones.g at gmail.com>
wrote:

> Thanks Scott for the response.
>
> That means that I have to go the ADFS and change the endopoint of the SP's
> app that Shib is using to send the assertion, in order to use an endpoint
> that's actually saml and not ws-federation, right?
>
> Thanks,
>
>
> On Thursday, January 22, 2015, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 1/22/15, 2:27 PM, "Thomas Jones" <thomas.jones.g at gmail.com> wrote:
>>
>>
>> >
>> >I've seen that when my external app sends the respond to Shib's Idp and
>> >this sends the respond to the ADFS, this one tries to access the next URL
>> >(but later on it sends the user back to my external app, to repeat the
>> >authentication process, as I have just
>> > mentioned):
>> >
>> >
>> >
>> https://adfs-domain/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2appcomain
>> .
>>
>> >com%2fapp.internet%2f&wfresh=5&wctx=rm%3d0%26id%3dpassive%26ru%3d%252fapp.
>> >internet%252fHome%252fStart&wct=2015-01-22T00%3a15%3a24Z
>>
>> That's WS-Federation, not SAML. Assuming you didn't already know that.
>>
>> >But after the user has repeated for the second time the authentication,
>> >the previous URL is not showed at all. Is this a miss configuration from
>> >the ADFS or Shib?
>>
>> Has nothing to do with Shibboleth.
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150122/9e9a9beb/attachment-0001.html