SingleSignOnService

[Sam Jacob]

I got a reply from the IDP,
what they are saying is , they will be doing a IDP initiated SSO and
therefore no need for  SingleSignOnService attribute.
Is this the case?

On Fri, Dec 2, 2016 at 1:39 PM, Sam Jacob <skjacob at gmail.com> wrote:

> Thanks Tom for the info.
>
> On Fri, Dec 2, 2016 at 12:49 PM, Tom Scavo <trscavo at gmail.com> wrote:
>
>> On Fri, Dec 2, 2016 at 1:33 PM, Sam Jacob <skjacob at gmail.com> wrote:
>> >
>> > no endpoints are provided.
>>
>> That's weird. A service provider needs to know where to send the
>> AuthnRequest. Without a trusted IdP endpoint location, there's no way
>> to begin the SAML flow.
>>
>> > The metadata contains just these entries
>> > x509, attributes and contact info.
>>
>> Of those, the certificate is most important, since you need that to
>> verify the signature on the response and/or the assertion the IdP
>> ultimately sends to you.
>>
>> Tom
>>
>> > On Fri, Dec 2, 2016 at 12:27 PM, Tom Scavo <trscavo at gmail.com> wrote:
>> >>
>> >> On Fri, Dec 2, 2016 at 12:54 PM, Liam Hoekenga <liamr at umich.edu>
>> wrote:
>> >> > Acc'd to the SAML spec, the IDPSSODescriptor element must include at
>> >> > least
>> >> > one SingleSignOnService:
>> >> >
>> >> > https://docs.oasis-open.org/security/saml/v2.0/saml-metadata
>> -2.0-os.pdf
>> >> > 2.4.3 Element <IDPSSODescriptor>
>> >> > <SingleSignOnService> [One or More]
>> >> > One or more elements of type EndpointType that describe endpoints
>> that
>> >> > support the profiles of
>> >> > the Authentication Request protocol defined in [SAMLProf]. All
>> identity
>> >> > providers support at least
>> >> > one such endpoint, by definition. The ResponseLocation attribute
>> MUST be
>> >> > omitted.
>> >>
>> >> Yes, that's correct, there must be at least one SingleSignOnService
>> >> endpoint.
>> >>
>> >> Question for Sam: If there's no SingleSignOnService endpoint, what
>> >> endpoints are there? (I just have to know :)
>> >>
>> >> Thanks,
>> >>
>> >> Tom
>> >>
>> >> > On Fri, Dec 2, 2016 at 11:43 AM, Sam Jacob <skjacob at gmail.com>
>> wrote:
>> >> >>
>> >> >> IDP provided their metadata file and it's missing the
>> >> >> SingleSignOnService
>> >> >> tag in the XML file.
>> >> >> and shib is giving an error: "metadata instance failed manual
>> >> >> validation
>> >> >> checking: IDPSSODescriptor must have at least one
>> SingleSignOnService.
>> >> >> "
>> >> >>
>> >> >> is "SingleSignOnService" a required attribute?
>> >> >> Can SSO work without "SingleSignOnService" ?
>> >> >>
>> >> >> thanks
>> >> >>
>> >> >> --
>> >> >> Sam Jacob
>> >> >>
>> >> >> --
>> >> >> To unsubscribe from this list send an email to
>> >> >> users-unsubscribe at shibboleth.net
>> >> >
>> >> >
>> >> >
>> >> > --
>> >> > To unsubscribe from this list send an email to
>> >> > users-unsubscribe at shibboleth.net
>> >> --
>> >> To unsubscribe from this list send an email to
>> >> users-unsubscribe at shibboleth.net
>> >
>> >
>> >
>> >
>> > --
>> > Sam Jacob
>> >
>> > --
>> > To unsubscribe from this list send an email to
>> > users-unsubscribe at shibboleth.net
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Sam Jacob
>



-- 
Sam Jacob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161205/10c59a83/attachment.html>