IdP Metadata

[Marco Malavolti]

I will try to suggest you the changes, but if someone sees mistakes, 
please, gives his correction:

vim /opt/shibboleth-idp/metadata.xml

======================================================================================================================
<IDPSSODescriptor> SECTION:
   – From the list of "protocolSupportEnumeration" remove:
     - urn:oasis:names:tc:SAML:1.1:protocol
     - urn:mace:shibboleth:1.0

   – Remove the endpoint:
     <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.example.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
     (and modify the index value of the next one to “1”)

   – Remove the endpoint:
     <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>

   – Replace the endpoint:
     <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
     with:
     <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
     (because my IdP uses persistent SAML NameIDs)

   - Remove the endpoint:
     <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://idp.example.org/idp/profile/Shibboleth/SSO"/>
   - Remove all ":8443" from the existing URL (such port is not used anymore)

<AttributeAuthorityDescriptor> Section:
   – From the list "protocolSupportEnumeration" replace the value of:
     - urn:oasis:names:tc:SAML:1.1:protocol
     with
     - urn:oasis:names:tc:SAML:2.0:protocol

   - Remove the comment from:
     <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.mi.garr.it/idp/profile/SAML2/SOAP/AttributeQuery"/>
   - Remove the endpoint:
     <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.example.org:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>

   - Remove all ":8443" from the existing URL (such port is not used anymore)

======================================================================================================================

Best Regards,
Marco


Il 22/06/2016 22.43, Joel Levin ha scritto:
> We are deploying an IdP for our organization -- all looks good so far.
>
> But I am not 100% sure I understand what to use for the metadata.
>
> We won't support SAML1 or 8443.
>
> So far, we have use the default generated when installed.
>
> Is there any guide on editing the metadata for what we need? With 
> something this security focused, I rather not guess......
>
>
>
>
>

-- 
Marco Malavolti
Consortium GARR - Servizio IDEM GARR AAI
Via dei Tizii, 6 - I-00185 (ROMA)
CF: 37284570583 - PI:07577141000
Skype: marco.mala

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160623/f2ca6256/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3608 bytes
Desc: Firma crittografica S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20160623/f2ca6256/attachment-0001.p7s>