SingleSignOnService

[Sam Jacob]

Thanks Tom for the info.

On Fri, Dec 2, 2016 at 12:49 PM, Tom Scavo <trscavo at gmail.com> wrote:

> On Fri, Dec 2, 2016 at 1:33 PM, Sam Jacob <skjacob at gmail.com> wrote:
> >
> > no endpoints are provided.
>
> That's weird. A service provider needs to know where to send the
> AuthnRequest. Without a trusted IdP endpoint location, there's no way
> to begin the SAML flow.
>
> > The metadata contains just these entries
> > x509, attributes and contact info.
>
> Of those, the certificate is most important, since you need that to
> verify the signature on the response and/or the assertion the IdP
> ultimately sends to you.
>
> Tom
>
> > On Fri, Dec 2, 2016 at 12:27 PM, Tom Scavo <trscavo at gmail.com> wrote:
> >>
> >> On Fri, Dec 2, 2016 at 12:54 PM, Liam Hoekenga <liamr at umich.edu> wrote:
> >> > Acc'd to the SAML spec, the IDPSSODescriptor element must include at
> >> > least
> >> > one SingleSignOnService:
> >> >
> >> > https://docs.oasis-open.org/security/saml/v2.0/saml-
> metadata-2.0-os.pdf
> >> > 2.4.3 Element <IDPSSODescriptor>
> >> > <SingleSignOnService> [One or More]
> >> > One or more elements of type EndpointType that describe endpoints that
> >> > support the profiles of
> >> > the Authentication Request protocol defined in [SAMLProf]. All
> identity
> >> > providers support at least
> >> > one such endpoint, by definition. The ResponseLocation attribute MUST
> be
> >> > omitted.
> >>
> >> Yes, that's correct, there must be at least one SingleSignOnService
> >> endpoint.
> >>
> >> Question for Sam: If there's no SingleSignOnService endpoint, what
> >> endpoints are there? (I just have to know :)
> >>
> >> Thanks,
> >>
> >> Tom
> >>
> >> > On Fri, Dec 2, 2016 at 11:43 AM, Sam Jacob <skjacob at gmail.com> wrote:
> >> >>
> >> >> IDP provided their metadata file and it's missing the
> >> >> SingleSignOnService
> >> >> tag in the XML file.
> >> >> and shib is giving an error: "metadata instance failed manual
> >> >> validation
> >> >> checking: IDPSSODescriptor must have at least one
> SingleSignOnService.
> >> >> "
> >> >>
> >> >> is "SingleSignOnService" a required attribute?
> >> >> Can SSO work without "SingleSignOnService" ?
> >> >>
> >> >> thanks
> >> >>
> >> >> --
> >> >> Sam Jacob
> >> >>
> >> >> --
> >> >> To unsubscribe from this list send an email to
> >> >> users-unsubscribe at shibboleth.net
> >> >
> >> >
> >> >
> >> > --
> >> > To unsubscribe from this list send an email to
> >> > users-unsubscribe at shibboleth.net
> >> --
> >> To unsubscribe from this list send an email to
> >> users-unsubscribe at shibboleth.net
> >
> >
> >
> >
> > --
> > Sam Jacob
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Sam Jacob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161202/c3aa79b4/attachment-0001.html>