Unsolicited SSO with no entity ID or metadata

[Ben Branch]

Scott,

You were absolutely correct about the SAML end point being the Entity ID for this SP.  I created the Metadata by hand and used their end point as the entityId value and everything worked like a champ.  Many thanks for your assistance!

Ben Branch
UNIX/Linux Administrator
University of Central Oklahoma
ITIL Foundation v3, Network+, RHCE

100 N. University Drive, Box 122
Edmond, OK 73034
D: 405.974.2649 | M: 405.550.6804 | bbranch at uco.edu | www.uco.edu
 
“I am wiser than this man, for neither of us appears to know anything great and good; but he fancies he knows something, although he knows nothing; whereas I, as I do not know anything, so I do not fancy I do. In this trifling particular, then, I appear to be wiser than he, because I do not fancy I know what I do not know.”  - Socrates

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, January 05, 2016 6:21 PM
To: Shib Users
Subject: Re: Unsolicited SSO with no entity ID or metadata

On 1/5/16, 5:59 PM, "users on behalf of Ben Branch" <users-bounces at shibboleth.net on behalf of BBranch at uco.edu> wrote:



>I asked them to provide me with the entity ID and the metadata and they advised that they do not publish their metadata, nor their entity ID.  The only piece of information that they were willing to provide me was the SAML endpoint.

It's possible that is their entityID, and it's also possible that they have a broken SAML implementation that's so limited it doesn't even care what you set the recipient's identifier to be. Of course it's also possible they don't know what they're doing. Probably more than one of those are true.

>So, with that said, here are my questions:
> 
>1. If I don’t have the entity id or the metadata, how am I supposed to properly configure the RelyingParty?

The metadata becomes your problem to create by hand, but you have to determine which of my suppositions is correct to ultimately create it and get things working. Initially if the endpoint location isn't too ugly you probably should just stick that into the entityID in the metadata and use that for now.

Invoking the IdP to get it to respond is done with the entityID as the parameter, rather than the endpoint location, but if they're set to the same value it doesn't much matter of course.

>2. If I don’t have the entity id, how am supposed to configure the attributes to be released to the right service?

You can't; there is always an entityID.

>3. Because this is Idp-Initiated SSO, do I need to build a metadata file for them on my side rather than having them provide me one?

You have to do that because they aren't giving you any, whether it's IdP-initiated or not.

> 
>I’m really at a loss right now.  I’ve been pouring over the Shibboleth wiki and Google looking for anything that can help me understand Idp-Initiated SSO.

There are no real metadata implications of IdP-initiated SSO, the metadata is what it would be no matter what end initiates.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net