Shibbolth IdP setting isssuer as AudienceRestriction

[Brent Putman]

On 6/11/15 12:55 PM, Alain O'Dea wrote:
> I changed
> https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19
> to:
> appSettings.setIssuer("http://localhost:8080/consume.jsp");
>
> And I changed the relyingPartyIds in the relying-party.xml override
> that disables assertion encryption:
>
>         <bean parent="RelyingPartyByName"
> c:relyingPartyIds="http://localhost:8080/consume.jsp">
>
>         </bean>
>
> And I changed the entityId in my SP metadata to
> http://localhost:8080/consume.jsp.


Just so you know: SAML entityIDs are not (typically) actual endpoints in
your app.   They usually don't include port numbers or reference
specific actual endpoints/pages. They typically are not resovleable
URL's, and are sometimes not even URL's at all - they can be URN's for
example, or technically any subtype of URI. They are just URIs used as
identifiers of the SAML actor, period.

What you have there may work for testing as long as you set everything
consistently. But a more realistic choice for the SP entityID would be
something like http://localhost/sp/onelogin, or even better, replace
localhost with an FQDN.

So what they're doing there by default with:

appSettings.setIssuer("http://localhost:8080/index.jsp");

is quite misleading.  On the other hand, the AssertionConsumerServiceUrl
setting is correct:

appSettings.setAssertionConsumerServiceUrl("http://localhost:8080/consume.jsp");

That should be the actual URL endpoint in the SP which will receive the
response back from the IdP.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/2c24967f/attachment-0001.html>