Shibbolth IdP setting isssuer as AudienceRestriction

[Alain O'Dea]

On 11 June 2015 at 11:57, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/11/15, 2:06 PM, "Alain O'Dea" <alain.odea at gmail.com> wrote:
>
>
> >
> >It almost works but the SAML token has an AudienceRestriction of
> >http://localhost:8080/index.jsp <http://localhost:8080/index.jsp> which
> >is the issuer, not the consumer.  The saml-java SP rejects this.
>
> The audience is whatever you've told that SP to send in its requests as
> its identity (the Issuer of the request in other words).
>
> And that should be what's in the SP's metadata at the IdP in the entityID,
> or it wouldn't even respond.
>
> -- Scott
>

Got it.  Thank you Scott.  That fixed my issue.

Specifically for the benefit of others (including myself in future):

I changed
https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19
to:
appSettings.setIssuer("http://localhost:8080/consume.jsp");

And I changed the relyingPartyIds in the relying-party.xml override that
disables assertion encryption:

        <bean parent="RelyingPartyByName" c:relyingPartyIds="
http://localhost:8080/consume.jsp">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"
                          p:encryptAssertions="false"

p:signAssertions="#{T(com.google.common.base.Predicates).alwaysTrue()}" />
                </list>
            </property>
        </bean>

And I changed the entityId in my SP metadata to
http://localhost:8080/consume.jsp.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/65ff952a/attachment.html>