SAML2 attribute query authentication for IdPv3

[David Langenberg]

Note: I'm not a .NET guy, but it looks like you have some options for overriding the handling of cert validation:

http://stackoverflow.com/questions/526711/using-a-self-signed-certificate-with-nets-httpwebrequest-response

Dave

> On Sep 14, 2015, at 8:30 AM, Scott Koranda <skoranda at gmail.com> wrote:
> 
> Hi,
> 
> I have deployed Shib IdPv3 3.x to use as a SAML2 attribute
> authority. I have a number of Shib SPs that use an ePPN
> asserted by an IdP to then query the IdPv3 attribute authority
> for more attributes about the user (the attribute authority is
> managed by a research organization). The IdPv3 is deployed in
> the "normal" way for a backchannel configuration--it uses a
> self-signed X.509 certificate as the key and for TLS.
> 
> I need to build out an AD FS 3 custom attribute store using
> .NET 4.5 to do that same thing as the Shibboleth SPs and query
> the attribute authority.
> 
> Most of that task is straightforward except for how the client
> authenticates to the attribute authority. The issue is best
> explained in this (unanswered) Stack Overflow post:
> 
> http://stackoverflow.com/questions/19125896/forcing-asp-net-webapi-client-to-send-a-client-certificate-even-when-no-ca-match
> 
> So far my experience is that I will not be able to have the
> client to TLS authentication to the IdPv3 SOAP endpoint.
> 
> If I decide to try and instead have the client authenticate by
> signing the attribute query, do I need to make any
> configuration changes to the IdPv3 or will this "just work".
> 
> Thanks,
> 
> Scott K
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

--
David Langenberg
Identity & Access Management Architect
The University of Chicago