IdP Initiated SSO

[Michael Dahlberg]

Scott:

Thank you very much, especially for the tips.

On a related note, is the option to encrypt/not encrypt the nameID
different when using Unsolicited SSO?  The reason I ask is because in the
bean for this entityId in the relying-party file, I have the following line:

p:encryptNameIDs="false"

Unfortunately, the nameId looks like its still being encrypted (with what,
I have no idea, since the metadata for this particular entityId does not
include an X509 cert).

Any suggestions?

Thanks,
Mike



On Mon, Aug 29, 2016 at 4:45 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> Also, pro tip: never let anybody embed links to your IdP via this protocol
> anywhere you don't control.
>
> Set up a directory of CGI scripts or whatever your tool of choice is and
> create "public" locations to give to people to use on web pages, and have
> those scripts do redirects to your IdP with the right parameters.
>
> Alternatively you could use a URL-shortening service if you have one
> available that gives you the ability to maintain the locations behind the
> shortened URLs.
>
> -- Scott
>
>
> On 8/29/16, 4:36 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>     Try https://wiki.shibboleth.net/confluence/display/IDP30/
> UnsolicitedSSOConfiguration
>
>     There's no such thing as unsolicited SSO. There are always requests.
> Some requests are SAML conformant and generated by an SP and some are
> proprietary and are just redirects or links on a web page. Some are
> digitally signed and some aren't.
>
>     Unsolicited SSO is just a proprietary, unsigned request protocol.
>
>     -- Scott
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160831/5c9a31e8/attachment.html>