IdP Metadata

[Joel Levin]

Thanks Marco :) Very helpful.

In the default IdP Metadata generated, there are 3 KeyDescriptor elements -
2 x signing, and 1 x encryption.

Only 1 is needed?

Thanks.

On Thu, Jun 23, 2016 at 12:16 AM, Marco Malavolti <marco.malavolti at garr.it>
wrote:

> I will try to suggest you the changes, but if someone sees mistakes,
> please, gives his correction:
>
> vim /opt/shibboleth-idp/metadata.xml
>
> ======================================================================================================================
> <IDPSSODescriptor> SECTION:
>   – From the list of "protocolSupportEnumeration" remove:
>     - urn:oasis:names:tc:SAML:1.1:protocol
>     - urn:mace:shibboleth:1.0
>
>   – Remove the endpoint:
>     <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.example.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution" <https://idp.example.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution> index="1"/>
>     (and modify the index value of the next one to “1”)
>
>   – Remove the endpoint:
>     <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
>
>   – Replace the endpoint:
>     <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
>     with:
>     <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
>     (because my IdP uses persistent SAML NameIDs)
>
>   - Remove the endpoint:
>     <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://idp.example.org/idp/profile/Shibboleth/SSO" <https://idp.example.org/idp/profile/Shibboleth/SSO>/>
>   - Remove all ":8443" from the existing URL (such port is not used anymore)
>
> <AttributeAuthorityDescriptor> Section:
>   – From the list "protocolSupportEnumeration" replace the value of:
>     - urn:oasis:names:tc:SAML:1.1:protocol
>     with
>     - urn:oasis:names:tc:SAML:2.0:protocol
>
>   - Remove the comment from:
>     <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.mi.garr.it/idp/profile/SAML2/SOAP/AttributeQuery" <https://idp.mi.garr.it/idp/profile/SAML2/SOAP/AttributeQuery>/>
>   - Remove the endpoint:
>     <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://idp.example.org:8443/idp/profile/SAML1/SOAP/AttributeQuery" <https://idp.example.org:8443/idp/profile/SAML1/SOAP/AttributeQuery>/>
>
>   - Remove all ":8443" from the existing URL (such port is not used anymore)
>
> ======================================================================================================================
>
> Best Regards,
> Marco
>
>
>
> Il 22/06/2016 22.43, Joel Levin ha scritto:
>
> We are deploying an IdP for our organization -- all looks good so far.
>
> But I am not 100% sure I understand what to use for the metadata.
>
> We won't support SAML1 or 8443.
>
> So far, we have use the default generated when installed.
>
> Is there any guide on editing the metadata for what we need? With
> something this security focused, I rather not guess......
>
>
>
>
>
>
> --
> Marco Malavolti
> Consortium GARR - Servizio IDEM GARR AAI
> Via dei Tizii, 6 - I-00185 (ROMA)
> CF: 37284570583 - PI:07577141000
> Skype: marco.mala
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160624/4995ac8e/attachment-0001.html>