Clarify SP

[Robert Lamothe]

- Is vendor a member?
- Is vendor's metadata registered with InCommon?
The answer is yes to both, our configuration page allows us to select InCommon from a list of relying parties.
We're making progress, we can see that the vendor is connecting to our IDP and data is being passed, what isn't clear is why we're failing.  On the diags page under verifications we see "No items were found. If the sign in attempt was successful, the associated user verifications have been deleted."  

One thing we wonder about, the vendor requires PersitentID as an attribute.  Based on my reading this is supposed to be generated by the IDP the first time a user connects from a specific SP.  We don't know how to verify that this is happening.  We don't see any attributes in the vendor diags and we don't see PersistentID when we use testshib.org.
Do you know of a way to verify that?
Regards-Bob
 --
Bob Lamothe
robert_lamothe at yahoo.com
KB1BOB
603-918-6336

 

    On Thursday, January 28, 2016 3:34 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
 

 >    Yes, this is all pretty new to me.  My background is in Unix, since all of this
> seems to be AD related it's been outside of my sphere.  But now I need to
> know it.

Not really AD related, no. ADFS is an add-on to AD that does federation protocols, Shibboleth is architected differently but also more agnostic about what it connects to.

>    Right now we have a goal to get Microsoft web store integrated with our
> Shibboleth IDP.  The documentation seems to assume that I know things that
> apparently I don't.  Testshib.org tells us our IDP is working, but we're at a lost
> how to get MS Web Store accessing it.

If you're an InCommon member, then you basically have to proceed as:

- Is vendor a member?
- Is vendor's metadata registered with InCommon?

If the answer is no to either, you have to convince them to do it, or more likely manage the trust relationship yourself.

If you're not an InCommon member, then you're in the vast wasteland of the enterprise where doing all this manually makes sense to people. Our software isn't geared toward that manual process being as friendly as it is in software that pretty much starts and ends with manual.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160128/2f777680/attachment.html>