Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

[Cahill, Charles (GE Appliances)]

This is starting to make sense but I still do not understand where you got this URL

https://urldefense.proofpoint.com/v2/url?u=https-3A__&d=AwIGaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=Ay4xjbXoe6YvlvYwTANr9ZsOm6cEXvasE-gwLIuoyN8&m=QYmBF9sfghMeK69QbjhfFfoYnUAU9cvRTzCmyBcK0wo&s=M-mQFDj9DXG-FzZoSG3vTADRKeLVITqcqL-BAGpB_ao&e=  + entityID + /sso/saml/consume

where is the "urldefense.proofpoint.com" coming from and where the that long https"3A*..etc." string come from?

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Monday, June 01, 2015 1:07 PM
To: users at shibboleth.net
Subject: Re: Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

* Cahill, Charles (GE Appliances) <Charles.Cahill at ge.com> [2015-06-01 18:27]:
> I am able to authenticate just fine, but continue to get “No Relying 
> Party” as seen in below logs not sure why Anonymous relying party is 
> not kicking in, as I have no entityID listed in my metatdata for the 
> pagerduty URI.  The only information PagerDuty asks for is the Cert, 
> and lDP login URI if you just select SAML2.0 option.

Instead of sending profile data about your subjects to any SP in the world that asks your IDP for it (by adding usable SAML profiles to the anonymous relying party) you should create minimal SAML SP metadata for the service, based on what you have.

You get the correct entityID from your process log, or by grabbing it from the browser during a login attempt (easiest with Mozilla Firefox and the SAML tracer extension). From their docs it seems the entityID is always "your-account.pagerduty.com" and the ACS URL for HTTP-POST is then https://urldefense.proofpoint.com/v2/url?u=https-3A__&d=AwIGaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=Ay4xjbXoe6YvlvYwTANr9ZsOm6cEXvasE-gwLIuoyN8&m=QYmBF9sfghMeK69QbjhfFfoYnUAU9cvRTzCmyBcK0wo&s=M-mQFDj9DXG-FzZoSG3vTADRKeLVITqcqL-BAGpB_ao&e=  + entityID + /sso/saml/consume, which would make the a minimal entity descriptor like this:

  <EntityDescriptor entityID="general-electric.pagerduty.com">
    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
      <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
        Location="https://urldefense.proofpoint.com/v2/url?u=https-3A__general-2Delectric.pagerduty.com_sso_saml_consume&d=AwIGaQ&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=Ay4xjbXoe6YvlvYwTANr9ZsOm6cEXvasE-gwLIuoyN8&m=QYmBF9sfghMeK69QbjhfFfoYnUAU9cvRTzCmyBcK0wo&s=g1rod01Od5a-PlM_E007cFepFrsj1YfwbXu7ylY5U2A&e= " index="0"/>
    </SPSSODescriptor>
  </EntityDescriptor>

And configure attribute resolving and release for this like for any other SP in your locally managed metadata.

Kevin already tried to answer the info they wanted from your IDP.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net