Zoom Integration with Shibboleth IdP

[Tom Scavo]

On Fri, Jan 23, 2015 at 11:47 AM, Qian, Yi <yqian at ku.edu> wrote:
>
> Can you explain the last comments, http redirect can't handle the signed SAML. I do not really understand the reason, the SP does not support signing?

You're confusing inbound and outbound bindings. Every SAML2 IdP should
support HTTP-Redirect and that should be the SP's first choice
(outbound). The primary *inbound* binding at the SP is HTTP-POST. Here
is an excerpt from the SAML2 Profiles spec:

"the identity provider issues a <Response> message to be delivered by
the user agent to the service provider. Either the HTTP POST, or HTTP
Artifact binding can be used to transfer the message to the service
provider through the user agent. The message may indicate an error, or
will include (at least) an authentication assertion. The HTTP Redirect
binding MUST NOT be used, as the response will typically exceed the
URL length permitted by most user agents."

Hope this helps,

Tom