Allowing the Metadata to determine end-points

[Antony den Dulk]

On Wed, Jan 27, 2016 at 3:54 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/27/16, 8:55 AM, "users on behalf of Peter Schober" <
> users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at>
> wrote:
>
>
>
> >* Antony den Dulk <antony at selestiasolutions.com> [2016-01-27 13:28]:
> >> I have received the following from another person using Shibboleth:
> >> "SAML 2.0 specifies different methods to assert an authentication
> request.
> >> Shibboleth out-of-the-box uses the method called 'non-specified' while
> our
> >> system uses the 'basic' method."
> >
> >At last I have never heard anyone talk about auth requests in those terms.
>
> They don't exist, there's no such SAML terminology.
>

That is what you get when talking to managers, I take it someone was trying
to explain the system in simple terms for them.


>
> >>Seemingly the one of the differences between the 2 methods is that when
> >> sending an authentication request the 1st method (Shibboleth standard)
> >> sends the AssertionConsumerServiceURL while the basic does not. The
> effect
> >> of the 2nd method is that the Metadata is used to determine the
> >> AssertionConsumerServiceURL allowing the setup of various reverse-proxy
> >> scenaries.
>
> There are three ways to specify the URL:
>
> - by value
> - by index
> - omitted and left to a default
>
> Not sending one is the opposite of "allowing set up of virtual proxy
> scenarios", because then the IdP has only one choice of URL to use and it
> will usually be the wrong one.
>
> By definition if you wanted the IdP to use a specific default URL, it is
> equivalent to simply asking it to use that URL. This is pretty much common
> sense.
>

The third option is what I was asked to use by the admin of the IdP (at
least from what I understood from him). "By Value" is the actual URI to use
and "By Index" is using an identifier that lets the IdP know which URI to
use from the Metadata? Correct me if my understanding is incorrect.


>
> >The downside of not sending the endpoint being that (unless the authn
> >request is signed) the IDP has no chance to verify that the location it
> >should send the response to is legit and belongs to the SP in question
> >(as Issuer of the request). Such a check is not optional according to
> >the spec, IIRC.
>
> Not sending it just tells the IdP to use the isDefault="true" endpoint in
> metadata, so it's equivalent. The one that's horrible is by index, because
> that relies on a parity between the indexing the SP did and the indexes in
> the metadata, and that's horrible coupling. We used to do that in
> Shibboleth SPs and I realized it was a big mistake and changed it. The IdP
> still supports it, always has.
>
> >> I have heard from another person that there is a way to arrange this in
> >> Shibboleth but they do not have details on how.
>
> There is, IIRC, no way to get an SP to issue a request with nothing in
> those two attributes. It will either specify the endpoint by value or index.
>
 So Shibboleth does not support option 3, which means I need to use one of
the other two. "By Value" I take it is the standard, if I want to switch it
to "By Index" (even though it is horrible) what do I need to do (link to
documentation would be great)?

Thanks for the help,
Antony
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160127/75a35039/attachment.html>