Shib 3.x & alternate credentials

[Cantor, Scott]

On 10/27/15, 6:02 PM, "Dave Bartholomew" <Dave.Bartholomew at csueastbay.edu> wrote:



> 
><util:list id="shibboleth.RelyingPartyOverrides">
>      <bean parent="RelyingPartyByName" c:relyingPartyIds="<SP entityID>" p:responderId="<production entityID>" >

Before jumping to any complicated conclusions, I would suggest defining a separate String bean for the entityID and using p:responderId-ref="beanname" to override it.

The parent bean is using responderId-ref to set the property and I just wonder if there's a flaw or issue in the way inheritance works with properties set via different Spring methods.

>However, if I take basically the same configuration and make it the DefaultRelyingParty as below, it works:

But that sort of shoots down that theory. That doesn't leave anything really. What you posted looks fine, and if it loaded successfully, it looks fine to me. At least to get the entityID changes. The security config would take me more time to check over.

I guess I would strip out the config down to the bare minimum and turn off SAML profiles altogether in the override. Just an empty override basically. If that "works" and responds to the SP, then all I can say is it's not matching, or isn't in place. The log should say what relying party definition applies.

-- Scott