Parsing vendor request/instruction for SAML SSO

[IAM David Bantz]

Closing the loop:

Turns out vendor (LeanKit) does care that the Subject is sent with
nameid-format:unspecified; other formats rejected as invalid login.

I thought I could just an SAML2StringNameID encoder to ePPN, but for reason
opaque to me that resulted in the correct identifier but unscoped NameID in
the Subject.  So I had to repurpose a different string attribute (the value
of which is orthographically identical to ePPN), adding the
SAML2StringNameID encoder.

On the plus side, they are at least using SP-initiated SSO.

David Bantz
U Alaska

On Wed, Feb 3, 2016 at 4:07 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 2/3/16, 7:15 PM, "users on behalf of IAM David Bantz" <
> users-bounces at shibboleth.net on behalf of dabantz at alaska.edu> wrote:
>
>
>
> >I read that as requiring the SAML Subject is the principal's email
> address [or ExternalUserName, adds a later qualification], encoded as a
> NameId, but with nameid-format:unspecified. Can that be right?
>
> I doubt they care, so the first thing to do is to assume they mean "give
> us a NameID matching what you want to provision users against", do that,
> use a suitable Format, and see if it works. Never use "unspecified" unless
> you have to.
>
> If it's also requiring IdP-initiated SSO, one of the things I'm coming to
> discover through recent experience is that there's a pretty high likelihood
> that their implementation will be missing security checks. That's common
> when they strip things down to that little.
>
> How much you care about that, and what you're willing to do about it, is
> obviously a local issue, but I'm pretty much down to assuming all SAML code
> I don't know the source of is broken. That seems to be true more often than
> not.
>
> The big flag is, do they have an entityID that they know is theirs? If not
> (i.e., they just hand you the ACS URL), they can't be checking Audience. If
> they're not checking Audience, they may not be checking Recipient,
> Destination, or replay. And so on.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160205/384e2d6a/attachment.html>