IdP v3 Relying Party Configuration

[Cantor, Scott]

> I'm trying to add Microsoft Office365 as a relying party. So far I've added the
> metadata and configured the required attributes and release policy. My IdP
> has been migrated to v3 rather than upgraded as I want to do things the v3
> way.

I still think that's a mistake until you have a working system you can live with and can make discrete changes after that which you can easily test and compare. That's a much simpler way to clean up the config.

> The Microsoft documentation is for IdPv2, and I'm a little bit confused
> as how to achieve the following v2 relying-party.xml snippet.

If they don't support encryption (and their metadata has no key in it), the simple way you can get things working is just to set the idp.encryption.optional property. That allows the IdP to auto-skip encryption any time the metadata has no key, and is generally a safe thing to do given that your metadata should be trusted.

>             <bean parent="SAML2.SSO.Profile" p:signAssertions="conditional" />

Terms like "conditional" and "never" are not allowed there. That's the old syntax. Those properties are "predicates", Java beans that implement a boolean interface to return true/false. You can get the old behavior, but it can't be expressed that way and it isn't usually needed because it's normally the default. When you override something, just use true or false and it will autowire in a special condition bean that returns that.

-- Scott