Shib IdP 3 and IOP online service

[Maja Wolniewicz]

W dniu 24.03.2015 o 13:14, Rod Widdowson pisze:
>> With this request I'm getting an error from
> It was just a thought.   I suspect I abused the IdPSSO protocol.  Don’t
> worry about it.
>
>> 2015-03-24 12:39:05,229 - DEBUG [PROTOCOL_MESSAGE:166] -
>> SAML 1 IdP-initiated request was:
> IdPInitiatedSSORequest{entityId=https://ticket.iop.org/shibboleth,
> acsURL=https://ticket.iop.org/Shibboleth.sso/SAML/POST,
>> relayState=cookie:534566a6, time=2015-03-24T11:39:04.000Z}
>> and then IdP produces <saml1p:response> and send it to
>>
>> I have the production IdP running simplesamlphp and there all works good.
> SAML tracer shows  that first
>> <samlp:AuthnRequest..> is sent, then <samlp:Response> and the POST goes to
> SAML2 endpoint https://ticket.iop.org/Shibboleth.sso/SAML2/POST
>
> That cannot be right can it?  If the request asked for ACS
> /Shibboleth.sso/SAML/POST, surely you need to send the response back there
> (not to a SAML2 endpoint), but that’s a SSP issue and so irrelevant except
> that I seem to recall a similar bug being fixed in the Shib IdP.
The SSP IdP gets
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://ticket.iop.org/Shibboleth.sso/SAML2/POST" 
Destination="https://idp.umk.pl/simplesaml/saml2/idp/SSOService.php" 
ID="_0d7b6e41b17c5a98e71019a113b9f4d2" 
IssueInstant="2015-03-24T11:33:53Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0">

Our SSP IdP does not support SAML1, Shib3 IdP supports - it probably 
causes that ticket.iop.org chooses SAML1 and removing SAML1 support 
should help.

>
> Do you have another SAML1 SP you can test against? If you are in edugain the
> UK Federation one is a handy place to start...
I will try with another SAML1 SP
>
> You might also want to check that you attribute resolvers have SAML1
> encoders attached.
They have.

Maja
>
> R
>

-- 
Maja Gorecka-Wolniewicz          mgw at umk.pl
Uczelniane Centrum               Information & Communication
Informatyczne                    Technology Centre
Uniwersytet Mikolaja Kopernika   Nicolaus Copernicus University
Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland
tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5278 bytes
Desc: Kryptograficzna sygnatura S/MIME
Url : http://shibboleth.net/pipermail/users/attachments/20150324/1715b063/attachment-0001.bin