Allowing the Metadata to determine end-points

[Antony den Dulk]

On Wed, Jan 27, 2016 at 4:16 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/27/16, 10:08 AM, "users on behalf of Antony den Dulk" <
> users-bounces at shibboleth.net on behalf of antony at selestiasolutions.com>
> wrote:
>
>
> >
> >
> >The reason not to send the information is so the Metadata becomes leading
> in determining endpoints.
>
> The metadata is *never* the lead. It's a verifier. If you don't specify an
> endpoint, all you're doing is telling it to use the one in the metadata
> marked as a default. If you wanted the default endpoint used, it would
> already send that value in the request if it's appropriate to use for the
> resource being protected.
>

The IdP is not using the metadata in this way, it does not verify the URI
that comes in a signed authentication request.


>
> > The IdP supports both methods of Authentication Requests - they (the IdP
> developers) claim that both methods are in the SAML 2.0 spec (see
> >https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf @
> page 59 row 2061) and that an SP that does not support both is not
> implementing the spec properly (in their
> > opinion).
>
> The two methods are Index and URL. Not sending either is functionally
> equivalent to using either method but with the value corresponding to the
> default.
>
> There is no requirement in SAML to support "send nothing",


Your understanding mirrors mine in this.


> and the Shibboleth SP's implementation does not make that a viable
> approach because its endpoints MUST correspond to the vhost of the resource
> being protected, so it can't default, it has to make sure the response
> comes back to an endpoint suitable for the resource. So it derives the
> endpoint at runtime, sends it in the request, and relies on deployers
> ensuring the metadata contains them.
>

So even using by Index may break the system. Thanks for sending me the link
in your other post.


>
> Gateway SPs that convert SAML to other protocols and don't share cookies
> between endpoints and resources have more flexibility and often rely on a
> single endpoint, since the resource might be on a completely different
> server. My SP is not a gateway and does not function that way.
>

Good to know.

Thanks for all the replies. I think I know enough to at least go a step
further.

Regards,
Antony
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160127/8570be5f/attachment.html>