Issues Setting up SAML2 with ServiceNow

[Sacilowski, Tadeusz]

I can confirm that there's no line break in the actual metadata file, so it
must have been an artifact of the email. And there is a signing key
present, I just redacted it.

Can you elaborate on the difference (as it relates to Shiboleth) between
encrypting the response vs signing the response?

I have the following in my relying-party.xml:

<rp:DefaultRelyingParty provider="
https://shib.tc.columbia.edu/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">
    <!--
        Each attribute in these profiles configuration is set to its
default value,
        that is, the values that would be in effect if those attributes
were not present.
        We list them here so that people are aware of them (since they seem
reluctant to
        read the documentation).
    -->
    <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile"
                             includeAttributeStatement="false"
                             assertionLifetime="PT5M"
                             signResponses="always"
                             signAssertions="always"
                             includeConditionsNotBefore="true"/>

    <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile"
                             assertionLifetime="PT5M"
                             signResponses="always"
                             signAssertions="always"
                             includeConditionsNotBefore="true"/>

    <rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile"
                             signResponses="always"
                             signAssertions="always"/>

    <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
                             includeAttributeStatement="true"
                             assertionLifetime="PT5M"
                             assertionProxyCount="0"
                             signResponses="always"
                             signAssertions="always"
                             encryptAssertions="conditional"
                             encryptNameIds="never"
                             includeConditionsNotBefore="true"/>

    <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
                             includeAttributeStatement="true"
                             assertionLifetime="PT5M"
                             assertionProxyCount="0"
                             signResponses="always"
                             signAssertions="always"
                             encryptAssertions="conditional"
                             encryptNameIds="never"
                             includeConditionsNotBefore="true"/>

    <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
                             assertionLifetime="PT5M"
                             assertionProxyCount="0"
                             signResponses="always"
                             signAssertions="always"
                             encryptAssertions="conditional"
                             encryptNameIds="never"
                             includeConditionsNotBefore="true"/>

    <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
                             signResponses="always"
                             signAssertions="always"
                             encryptAssertions="conditional"
                             encryptNameIds="never"/>

    <rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"
                             signResponses="always"/>

</rp:DefaultRelyingParty>

>From your comment, I'm assuming that the use="signing" restriction means
that the key can only be used for signing the requests/assertions and not
encrypting it. I see above that I have encryptAssertions="conditional" (
saml:SAML2ECPProfile). What determines this conditional behavior? Can I
just remove the "signing" restriction?

Thank you!
Teddy

On Wed, Mar 11, 2015 at 9:56 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/11/15, 5:31 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
>
> >* Cantor, Scott <cantor.2 at osu.edu> [2015-03-11 02:31]:
> >> On 3/11/15, 1:22 AM, "Sacilowski, Tadeusz" <ts2878 at tc.columbia.edu>
> wrote:
> >> >This is the metadata generated by ServiceNow (referenced above):
> >>
> >> Which has no key in it.
> >
> >To add a bit verbosity to that: The metadata has no key usable for
> >encryption in it (note the use="signing" restriction).
>
> If there was a signing key, I missed that, but same difference, yes.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
*Tadeusz Sacilowski*
*Manager, Portal & Mobile Development*
Teachers College, Columbia University
sacilowski at tc.columbia.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150311/5c54821c/attachment.html