Allowing the Metadata to determine end-points

[Antony den Dulk]

On Wed, Jan 27, 2016 at 2:55 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Antony den Dulk <antony at selestiasolutions.com> [2016-01-27 13:28]:
>
8<

> > Seemingly the one of the differences between the 2 methods is that when
> > sending an authentication request the 1st method (Shibboleth standard)
> > sends the AssertionConsumerServiceURL while the basic does not. The
> effect
> > of the 2nd method is that the Metadata is used to determine the
> > AssertionConsumerServiceURL allowing the setup of various reverse-proxy
> > scenaries.
>
> The downside of not sending the endpoint being that (unless the authn
> request is signed) the IDP has no chance to verify that the location it
> should send the response to is legit and belongs to the SP in question
> (as Issuer of the request). Such a check is not optional according to
> the spec, IIRC.
>

The Authentication Request is signed.


>
> > I have heard from another person that there is a way to arrange this in
> > Shibboleth but they do not have details on how.
>
> The question is why change the Shib SP from providing legal and useful
> (if not signing: required) information?
> If the IDP does not support valid auth requests it has a bug.


The reason not to send the information is so the Metadata becomes leading
in determining endpoints. The IdP supports both methods of Authentication
Requests - they (the IdP developers) claim that both methods are in
the SAML 2.0 spec (see
https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf @ page
59 row 2061) and that an SP that does not support both is not implementing
the spec properly (in their opinion).

Thanks for taking the time to answer,
Antony
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160127/cfef8070/attachment.html>