Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

[Cantor, Scott]

On 6/11/15, 7:42 PM, "Cahill, Charles (GE Appliances)" 
<Charles.Cahill at ge.com> wrote:



>Pager Duty also sent me this.  Which they don’t seem to be much help in 
>getting this configured.
> 
>While we couldn't tell you exactly how to make the changes, the following 
>is the information you would need to configure Shibboleth with us.Entity 
>ID= "<subdomain>.pagerduty.com"
>
>ACS URL = "https://<subdomain>.pagerduty.com/sso/saml/consume

Those two pieces of data are the minimum bits needed to mock up a SAML 
metadata file (an EntityDescriptor and SPSSODescriptor role element) that 
supplies the IdP with what it needs. The entityID attribute and the 
Location value in the AssertionConsumerService elements are essentially 
the parts that are not boilerplate material.

>We expect the NameID claim as a 1.1 format email address. Specifically, 
>it will look something like this: <Subject><NameID 
>Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">matt at examp
>le.com</NameID>

Well, you can put that value into the SP metadata file you create in a 
<NameIDFormat> element. That triggers the IdP to try and produce a NameID 
with that format. How that is actually done within the IdP depends on the 
IdP version and is documented.

>There's no need to encrypt the responses as they are sent over HTTPS.

It's nice of them to unilaterally decide that for you, but you'll have to 
take that up with them. If you don't want to encrypt, you'll have to turn 
that off, which again is done differently depending on the IdP version, 
and is documented.

-- Scott