relying-party.xml in V3/unsolicitedSSO

[Cantor, Scott]

On 8/30/16, 3:46 PM, "users on behalf of Nickles, Brent" <users-bounces at shibboleth.net on behalf of bnick001 at umaryland.edu> wrote:

> I’m attempting UnsolicitedSSO and I’m different issues in both development and production:
> in development the ACS I’m getting the following (perhaps the space in ?c=umb test)

Well, right, that's not legal. If this is unsolicited, then perhaps you just fed it in improperly as the shire parameter. You shouldn't really need such a parameter, it should be in the metadata as the default ACS endpoint to use, and then you just let it drive automatically.


> I have the following in the relying-party.xml for version 2.x; I’m trying to convert to a
> 3.x.    I’m hoping it’s simply replicating the signResponses=”always” but that seem to
> fail as well.  Is this where the custom bean comes into play? 

Umm, no, not really. Your custom relying party there is just turning encryption off. You can certainly do that in V3, or you could set the idp.encryption.optional property and have it auto-disable encryption for any SP without a key in its metadata.

>    The application is reporting:  [SSOException: Failed to verify the XML signature.] 

I don't understand, you couldn't get an error like that if the IdP is raising that URL exception, it wouldn't ever get to the point of sending the response on to the SP...


> <bean parent="RelyingPartyByName" c:relyingPartyIds="webtma.umaryland.edu/sp">

Note that that's an invalid entityID, they have to be absolute URIs.

-- Scott