SingleSignOnService

[Tom Scavo]

On Fri, Dec 2, 2016 at 12:54 PM, Liam Hoekenga <liamr at umich.edu> wrote:
> Acc'd to the SAML spec, the IDPSSODescriptor element must include at least
> one SingleSignOnService:
>
> https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf
> 2.4.3 Element <IDPSSODescriptor>
> <SingleSignOnService> [One or More]
> One or more elements of type EndpointType that describe endpoints that
> support the profiles of
> the Authentication Request protocol defined in [SAMLProf]. All identity
> providers support at least
> one such endpoint, by definition. The ResponseLocation attribute MUST be
> omitted.

Yes, that's correct, there must be at least one SingleSignOnService endpoint.

Question for Sam: If there's no SingleSignOnService endpoint, what
endpoints are there? (I just have to know :)

Thanks,

Tom

> On Fri, Dec 2, 2016 at 11:43 AM, Sam Jacob <skjacob at gmail.com> wrote:
>>
>> IDP provided their metadata file and it's missing the SingleSignOnService
>> tag in the XML file.
>> and shib is giving an error: "metadata instance failed manual validation
>> checking: IDPSSODescriptor must have at least one SingleSignOnService. "
>>
>> is "SingleSignOnService" a required attribute?
>> Can SSO work without "SingleSignOnService" ?
>>
>> thanks
>>
>> --
>> Sam Jacob
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net