Zoom Integration with Shibboleth IdP

[Leung, Warren]

Hi,

We have a department that currently has a license for Zoom a cloud based video conferencing and communications and they would like to integrate with our IdP.  Does anyone have any experiencing integrating with them?

After reading the documentation and speaking with their support I ran into a couple of issues.

They do not support encrypted assertions.  From what I've seen there have been a lot of vendor applications that have their own SAML implementations that do not support encrypted assertions.  So I guess this is more of a comment than a question/issues.

This is my stupid question, but looking at the metadata they provided it appears that it does not contain any certificate information.  Their support provided the following "We do receive iDP cert but we not require SP cert as we do not sign requests and response sent to the Identity Provider today. The SSO sign-in page is transmitted over https only."  The schema allows for 0 KeyDescriptors, but I have never run into a scenario where a SP had 0.  Does anyone have any experience working with this?  I am not even sure if this will work and if signing isn't enabled it just doesn't seem secure.  The metadata I am referring to is below.


<?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="ucla.zoom.us"><md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://ucla.zoom.us/saml/SingleLogout" ResponseLocation="https://ucla.zoom.us/saml/SingleLogout"/><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ucla.zoom.us/saml/SingleLogout" ResponseLocation="https://ucla.zoom.us/saml/SingleLogout"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://ucla.zoom.us/saml/SSO" index="0" isDefault="true"/><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ucla.zoom.us/saml/SSO" index="1"/></md:SPSSODescriptor></md:EntityDescriptor>


Thanks


Warren
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150123/e9eb8f1e/attachment-0001.html