SP Create IdP Metadata

[Peter Schober]

* Mark Neidig <mneidig at ftni.com> [2015-03-09 18:15]:
> Peter explained that "Step one[to configuring a new IdP] is always
> to acquire (or create) SAML metadata for both IDPs and add them to
> your SP via MetadataProviders."
> 
> The IdP is not Shibboleth. The admin for the IdP is not aware of
> SAML metadata files for his IdP let alone generating them. 

Then you'll have to do its job and get the same information in some
other form(at) from the IDP operator.

> How do I "create" the IdP metadata file as Peter suggested?

>From the documentation home ->
https://wiki.shibboleth.net/confluence/display/SHIB2/UnderstandingShibboleth
-> https://wiki.shibboleth.net/confluence/display/SHIB2/Metadata
-> https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForIdP

There you'll find explanations and an example at the end.

For anything further you'd need concrete info from the IDP.

Now, if I had to /guess/ you can probably remove the
ArtifactResolutionService and NameIDFormat elements and a single
SingleSignOnService element would probably do (but you'd still need to
find out the Binding and the Location from the IDP operator; unless
the IDP always sends unsolicited responses and subjects never start at
your SP, in which case you can probably supply bogus values such as
the ones below). You can probably also remove everything from the
example in the wiki after the end (closing tag) of the
IDPSSODescriptor element, giving you something like this:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://idp.example.org/idp/shibboleth">
  <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>
           ... base64-encoded certificate elided ...
          </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:SingleSignOnService Location="https://idp.example.org/idp/profile/SAML2/Redirect/SSO" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
  </md:IDPSSODescriptor>
</md:EntityDescriptor>

Obviously you'd need to replace the entityID with the name of the IDP
and the base64-encoded certificate needs to go into the
ds:X509Certificate element.

Write that into a file in your shibboleth2 directory
(e.g. example-idp.xml) and reference it in a MetadataProvider in your
shibboleth2.xml configration, as per the documentation:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddIdP
e.g.
<MetadataProvider type="XML" path="example-idp.xml" />

-peter