Allowing the Metadata to determine end-points

[Cantor, Scott]

On 1/27/16, 8:55 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:



>* Antony den Dulk <antony at selestiasolutions.com> [2016-01-27 13:28]:
>> I have received the following from another person using Shibboleth:
>> "SAML 2.0 specifies different methods to assert an authentication request.
>> Shibboleth out-of-the-box uses the method called 'non-specified' while our
>> system uses the 'basic' method."
>
>At last I have never heard anyone talk about auth requests in those terms.

They don't exist, there's no such SAML terminology.

>>Seemingly the one of the differences between the 2 methods is that when
>> sending an authentication request the 1st method (Shibboleth standard)
>> sends the AssertionConsumerServiceURL while the basic does not. The effect
>> of the 2nd method is that the Metadata is used to determine the
>> AssertionConsumerServiceURL allowing the setup of various reverse-proxy
>> scenaries.

There are three ways to specify the URL:

- by value
- by index
- omitted and left to a default

Not sending one is the opposite of "allowing set up of virtual proxy scenarios", because then the IdP has only one choice of URL to use and it will usually be the wrong one.

By definition if you wanted the IdP to use a specific default URL, it is equivalent to simply asking it to use that URL. This is pretty much common sense.

>The downside of not sending the endpoint being that (unless the authn
>request is signed) the IDP has no chance to verify that the location it
>should send the response to is legit and belongs to the SP in question
>(as Issuer of the request). Such a check is not optional according to
>the spec, IIRC.

Not sending it just tells the IdP to use the isDefault="true" endpoint in metadata, so it's equivalent. The one that's horrible is by index, because that relies on a parity between the indexing the SP did and the indexes in the metadata, and that's horrible coupling. We used to do that in Shibboleth SPs and I realized it was a big mistake and changed it. The IdP still supports it, always has.

>> I have heard from another person that there is a way to arrange this in
>> Shibboleth but they do not have details on how.

There is, IIRC, no way to get an SP to issue a request with nothing in those two attributes. It will either specify the endpoint by value or index.

-- Scott