Shibbolth IdP setting isssuer as AudienceRestriction

[Alain O'Dea]

On 11 June 2015 at 22:49, Brent Putman <putmanb at georgetown.edu> wrote:

>
>
> On 6/11/15 8:37 PM, Alain O'Dea wrote:
>
>
> That is extremely helpful Brent.  Thank you.  It seemed odd to have a
> specific page referenced.  Regrettably, saml-java explicitly couples the
> issuer to the consumerServiceURL here:
>
> https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/src/main/java/com/onelogin/saml/Response.java#L163-165
>
>
> Yeah, if I'm reading that right, that's simply wrong.  The Assertion
> audiences should be evaluated against the consuming party's entityID.  An
> Audience is not a location or URL.  The protocol Destination and
> SubjectConfirmation should be evaluated against the receiving endpoint, but
> not the Audiences.
>
>
> I don't have a choice about issuer being a URL unless I reimplement using
> OpenSAML.  That is becoming a more compelling path now as more gaps in
> saml-java reveal themselves.
>
>
> Since you mention it: as part of a particular body of work, I've just
> recently checked into OpenSAML 3.x trunk our initial impl of components for
> SAML 2 Assertion validation, which essentially does this sort of thing. It
> will be in the next release.
>

Great!  Thank you Brent.  I will check into that.  This is in the early
stages so it's good to pick a competent implementation like OpenSAML from
day one.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/c3459d97/attachment.html>