Shibbolth IdP setting isssuer as AudienceRestriction

[Alain O'Dea]

On 11 June 2015 at 15:45, Brent Putman <putmanb at georgetown.edu> wrote:

>
>
> On 6/11/15 12:55 PM, Alain O'Dea wrote:
>
>  I changed
> https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19
> to:
> appSettings.setIssuer("http://localhost:8080/consume.jsp");
>
>  And I changed the relyingPartyIds in the relying-party.xml override that
> disables assertion encryption:
>
>          <bean parent="RelyingPartyByName" c:relyingPartyIds="
> http://localhost:8080/consume.jsp">
>
>         </bean>
>
>  And I changed the entityId in my SP metadata to
> http://localhost:8080/consume.jsp.
>
>
>
> Just so you know: SAML entityIDs are not (typically) actual endpoints in
> your app.   They usually don't include port numbers or reference specific
> actual endpoints/pages. They typically are not resovleable URL's, and are
> sometimes not even URL's at all - they can be URN's for example, or
> technically any subtype of URI. They are just URIs used as identifiers of
> the SAML actor, period.
>
> What you have there may work for testing as long as you set everything
> consistently. But a more realistic choice for the SP entityID would be
> something like http://localhost/sp/onelogin, or even better, replace
> localhost with an FQDN.
>
> So what they're doing there by default with:
>
> appSettings.setIssuer("http://localhost:8080/index.jsp");
>
> is quite misleading.  On the other hand, the AssertionConsumerServiceUrl
> setting is correct:
>
> appSettings.setAssertionConsumerServiceUrl(
> "http://localhost:8080/consume.jsp" <http://localhost:8080/consume.jsp>);
>
> That should be the actual URL endpoint in the SP which will receive the
> response back from the IdP.
>

That is extremely helpful Brent.  Thank you.  It seemed odd to have a
specific page referenced.  Regrettably, saml-java explicitly couples the
issuer to the consumerServiceURL here:
https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/src/main/java/com/onelogin/saml/Response.java#L163-165

I don't have a choice about issuer being a URL unless I reimplement using
OpenSAML.  That is becoming a more compelling path now as more gaps in
saml-java reveal themselves.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/4ffb836a/attachment.html>