SingleSignOnService

[Tom Scavo]

On Fri, Dec 2, 2016 at 1:33 PM, Sam Jacob <skjacob at gmail.com> wrote:
>
> no endpoints are provided.

That's weird. A service provider needs to know where to send the
AuthnRequest. Without a trusted IdP endpoint location, there's no way
to begin the SAML flow.

> The metadata contains just these entries
> x509, attributes and contact info.

Of those, the certificate is most important, since you need that to
verify the signature on the response and/or the assertion the IdP
ultimately sends to you.

Tom

> On Fri, Dec 2, 2016 at 12:27 PM, Tom Scavo <trscavo at gmail.com> wrote:
>>
>> On Fri, Dec 2, 2016 at 12:54 PM, Liam Hoekenga <liamr at umich.edu> wrote:
>> > Acc'd to the SAML spec, the IDPSSODescriptor element must include at
>> > least
>> > one SingleSignOnService:
>> >
>> > https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf
>> > 2.4.3 Element <IDPSSODescriptor>
>> > <SingleSignOnService> [One or More]
>> > One or more elements of type EndpointType that describe endpoints that
>> > support the profiles of
>> > the Authentication Request protocol defined in [SAMLProf]. All identity
>> > providers support at least
>> > one such endpoint, by definition. The ResponseLocation attribute MUST be
>> > omitted.
>>
>> Yes, that's correct, there must be at least one SingleSignOnService
>> endpoint.
>>
>> Question for Sam: If there's no SingleSignOnService endpoint, what
>> endpoints are there? (I just have to know :)
>>
>> Thanks,
>>
>> Tom
>>
>> > On Fri, Dec 2, 2016 at 11:43 AM, Sam Jacob <skjacob at gmail.com> wrote:
>> >>
>> >> IDP provided their metadata file and it's missing the
>> >> SingleSignOnService
>> >> tag in the XML file.
>> >> and shib is giving an error: "metadata instance failed manual
>> >> validation
>> >> checking: IDPSSODescriptor must have at least one SingleSignOnService.
>> >> "
>> >>
>> >> is "SingleSignOnService" a required attribute?
>> >> Can SSO work without "SingleSignOnService" ?
>> >>
>> >> thanks
>> >>
>> >> --
>> >> Sam Jacob
>> >>
>> >> --
>> >> To unsubscribe from this list send an email to
>> >> users-unsubscribe at shibboleth.net
>> >
>> >
>> >
>> > --
>> > To unsubscribe from this list send an email to
>> > users-unsubscribe at shibboleth.net
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
>
>
> --
> Sam Jacob
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net