Zoom Integration with Shibboleth IdP

[David Langenberg]

I don't have experience with zoom, but I do have ample experience with
other SPs that can't accept encrypted assertions.  If they don't accept
encrypted assertions, then it's perfectly normal to not have any certs in
their metadata.  Shib should load it up just fine.  Don't forget to adjust
your relying-party.xml and be explicit about no encryption for that SP if
your defaults are to always encrypt.

Dave

On Thu, Jan 22, 2015 at 9:14 PM, Leung, Warren <wleung at it.ucla.edu> wrote:

>  Hi,
>
>  We have a department that currently has a license for Zoom a cloud based
> video conferencing and communications and they would like to integrate with
> our IdP.  Does anyone have any experiencing integrating with them?
>
>  After reading the documentation and speaking with their support I ran
> into a couple of issues.
>
>  They do not support encrypted assertions.  From what I’ve seen there
> have been a lot of vendor applications that have their own SAML
> implementations that do not support encrypted assertions.  So I guess this
> is more of a comment than a question/issues.
>
>  This is my stupid question, but looking at the metadata they provided it
> appears that it does not contain any certificate information.  Their
> support provided the following "We do receive iDP cert but we not require
> SP cert as we do not sign requests and response sent to the Identity
> Provider today. The SSO sign-in page is transmitted over https only.”  The
> schema allows for 0 KeyDescriptors, but I have never run into a scenario
> where a SP had 0.  Does anyone have any experience working with this?  I am
> not even sure if this will work and if signing isn’t enabled it just
> doesn’t seem secure.  The metadata I am referring to is below.
>
>  <?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="ucla.zoom.us"><md:SPSSODescriptor
> AuthnRequestsSigned="false" WantAssertionsSigned="true"
> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://ucla.zoom.us/saml/SingleLogout" ResponseLocation="
> https://ucla.zoom.us/saml/SingleLogout"/><md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://ucla.zoom.us/saml/SingleLogout" ResponseLocation="
> https://ucla.zoom.us/saml/SingleLogout"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://ucla.zoom.us/saml/SSO" index="0"
> isDefault="true"/><md:AssertionConsumerService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://ucla.zoom.us/saml/SSO"
> index="1"/></md:SPSSODescriptor></md:EntityDescriptor>
>
>
>  Thanks
>
>
>  Warren
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150122/828b43eb/attachment.html