AWS + ECP?

[John Dennis]

On 02/05/2016 03:35 PM, Liam Hoekenga wrote:
>
> On Fri, Feb 5, 2016 at 12:01 PM, Cantor, Scott <cantor.2 at osu.edu
> <mailto:cantor.2 at osu.edu>> wrote:
>
>     Those are all DEBUG messages. If there's nothing on INFO, that's a
>     problem.
>
>
> The only INFO generated by that transaction is..
> 2016-02-05 15:33:34,567 - INFO [Shibboleth-Audit.SSO:241] -
> xxx.xxx.xxx.xxx  -
> 20160205T203334Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_B9228743684D4D4FB9B4C4439D4D15D1|urn:amazon:webservices|http://shibboleth.net/ns/profiles/saml2/sso/ecp|https://shib-idp-test.www.umich.edu/idp/shibboleth|||||||
>
>     The trigger for this is specifying an ACS with a non-PAOS binding?
>
>
> Yessir.

This is *not* a valid ECP SOAP request. It's completely missing the 
<paos:Request> and <ecp:Request> SOAP headers.

Also, does the SP metadata provided to the IdP contain a valid ACS for PAOS?


>
> <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
>      <S:Body>
>          <samlp:AuthnRequest
>
> AssertionConsumerServiceURL="https://signin.aws.amazon.com/saml"
>              ID="_B9228743684D4D4FB9B4C4439D4D15D1"
>              IssueInstant="2016-02-05T20:33:44"
>
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>              Version="2.0"
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
>              <saml:Issuer
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:amazon:webservices</saml:Issuer>
>              <samlp:NameIDPolicy AllowCreate="1"/>
>              <samlp:Scoping>
>                  <samlp:IDPList>
>                      <samlp:IDPEntry
> ProviderID="https://shib-idp-test.www.umich.edu/idp/shibboleth"/>
>                  </samlp:IDPList>
>              </samlp:Scoping>
>          </samlp:AuthnRequest>
>      </S:Body>
> </S:Envelope>
>
>


-- 
John