Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

[IAM David Bantz]

On Mon, Jun 1, 2015 at 9:05 AM, Cahill, Charles (GE Appliances) <
Charles.Cahill at ge.com> wrote:

> Okay,  am I supposed to generate some fake metadata to put in on the shib
> IDP side since I cannot get any out
> of PagerDuty?
>
> I believe so, yes.  If they don't provide a certificate, you may also need
to include a custom relying-party config for them.

<!-- VendorX provides no metadata or cert, so fake it  -->

<EntityDescriptor entityID="https://X.com"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">

   <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

        <md:Extensions xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">

        <mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">

        <mdui:DisplayName xml:lang="en">Vendor X Service</mdui:DisplayName>

        </mdui:UIInfo>

        </md:Extensions>


<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

       <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

           Location="{They will have to give you this much - a URL}" />

   </SPSSODescriptor>

</EntityDescriptor>

in relying-party.xml (Shibb 2):

<!-- VendorX provides no metadata or cert, so disable encryption  -->

   <RelyingParty id="https://X.com"
       provider={yourEntityID}
       defaultSigningCredentialRef="IdPCredential"

defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
     <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />
   </RelyingParty>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150601/20ac447a/attachment-0001.html>