SAML2 attribute query authentication for IdPv3

[Scott Koranda]

Hi Dave,

> Note: I'm not a .NET guy, but it looks like you have some options for overriding the handling of cert validation:
> 
> http://stackoverflow.com/questions/526711/using-a-self-signed-certificate-with-nets-httpwebrequest-response

That addresses when the server has a self-signed certificate
and the client needs to be able to validate it. I have that
part coded up.

The issue here is that the client wants to use a self-signed
certificate for TLS but it appears that the .NET 4.5 framework
does not allow that--as far as I can tell. If anybody knows
how to work around the issue I would appreciate a private note
to me and I will summarize for the list archive.

Thanks,

Scott K



> 
> Dave
> 
> > On Sep 14, 2015, at 8:30 AM, Scott Koranda <skoranda at gmail.com> wrote:
> > 
> > Hi,
> > 
> > I have deployed Shib IdPv3 3.x to use as a SAML2 attribute
> > authority. I have a number of Shib SPs that use an ePPN
> > asserted by an IdP to then query the IdPv3 attribute authority
> > for more attributes about the user (the attribute authority is
> > managed by a research organization). The IdPv3 is deployed in
> > the "normal" way for a backchannel configuration--it uses a
> > self-signed X.509 certificate as the key and for TLS.
> > 
> > I need to build out an AD FS 3 custom attribute store using
> > .NET 4.5 to do that same thing as the Shibboleth SPs and query
> > the attribute authority.
> > 
> > Most of that task is straightforward except for how the client
> > authenticates to the attribute authority. The issue is best
> > explained in this (unanswered) Stack Overflow post:
> > 
> > http://stackoverflow.com/questions/19125896/forcing-asp-net-webapi-client-to-send-a-client-certificate-even-when-no-ca-match
> > 
> > So far my experience is that I will not be able to have the
> > client to TLS authentication to the IdPv3 SOAP endpoint.
> > 
> > If I decide to try and instead have the client authenticate by
> > signing the attribute query, do I need to make any
> > configuration changes to the IdPv3 or will this "just work".
> > 
> > Thanks,
> > 
> > Scott K
> > -- 
> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> David Langenberg
> Identity & Access Management Architect
> The University of Chicago
> 
> 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net