Using IDP V3 for SSO with AWS

[Brent Putman]

On 11/18/15 5:12 PM, Wessel, Keith wrote:
>      <rp:ProfileConfiguration         xsi:type="saml:SAML2SSOProfile"       
> includeAttributeStatement="true"        assertionLifetime="PT5M" assertionProxyCount="0"        signResponses="never" signAssertions="always"        encryptAssertions="never" encryptNameIds="never"        includeConditionsNotBefore="true"        maximumSPSessionLifetime="PT1H" />
>  </rp:RelyingParty>
>
> Based on what I think I've found the defaults for SAML2SSO, I've added the following override block to my V3 relying-party.xml:
>
>         <bean parent="RelyingPartyByName" c:relyingPartyIds="urn:amazon:webservices">
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO" p:encryptAssertions="false"
>                         p:signResponses="false" p:signAssertions="true" />
>                 </list>
>             </property>
>         </bean>

Off-hand I'm not seeing any obvious problems with that

>        
>
>
> Am I missing something? Or is the relying party configuration not the issue? Anyone have advice for other pieces of the IDP configuration where I might have gone astray?
>


I've never setup AWS, so I can't offer specific IdP config suggestions
but:  If you have a v2 IdP working with AWS, then you might just
capture (via Firefox SAML Tracer, etc) the working v2 Response and the
non-working v3 Response, and compare them.  Find the significant deltas
and work back from there to the necessary config changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151118/241a65bc/attachment-0001.html>