SAML1 for particular Relying Party within a federation

Keith Carr kecarr at
Mon May 11 07:49:13 EDT 2015

From: users [mailto:users-bounces at] On Behalf Of Ian Young
Sent: 11 May 2015 12:17
To: Shib Users
Subject: Re: SAML1 for particular Relying Party within a federation

On 11 May 2015, at 11:58, Keith Carr <kecarr at<mailto:kecarr at>> wrote:

I’m basically looking to force one SP that provides it’s metadata via the UKfederation to use SAML1 for its response and assertion.

Unless you're going to be sending unsolicited responses, it is the SP's choice that will determine which protocol is used for the transaction. If the SP sends you a SAML 2 authentication request, you will be replying using SAML 2 or not at all. An SP will of course not do that if it can see that you only support SAML 1.

Can you give us some idea as to why you want to not use SAML 2 if it's available to both parties?

With the  recent vulnerabilities exposed within the TLS/SSL protocols (POODLE) we tightened up server configs, including setting Tomcat to work with TLS 1.0 as a minimum requirement. However we have found doing so “breaks” SAML1.x assertion exchange with one of the SP’s (Ovid). It seems like they are some time away from addressing the security vulnerability themselves and moving to SAML2.x.
To be honest, with what you’ve said now I think I’ve realised there’s no way around it until they have applied updates.
Thanks for your help,

- Keith

    -- Ian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the users mailing list