AWS + ECP?

[Brent Putman]

On 2/5/16 6:50 PM, Brent Putman wrote:
>   For example the binding it's sending is bogus, since it's not going
> to do that anyway, as would be the AWS SP metadata.


To answer one of the technical questions raised: Their metadata is here
[1] and only includes 1 ACS, with the SAML 2 POST binding:

<AssertionConsumerService index="1" isDefault="true"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://signin.aws.amazon.com/saml"/>


They also support standard SAML 2 Web SSO profile for the admin console
UI, etc, so this is I believe used for that also.  So as far as the
guy's script goes, he's naively doing what AWS wants him to do to make
it work, bogus as it is.

Interestingly they also have in there an AttributeConsumingService,
with a whole slew of RequestedAttributes from the eduPerson spec.  Oh boy.


[1] https://signin.aws.amazon.com/static/saml-metadata.xml
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160205/66f658e2/attachment.html>