login failed for scitation.aip.org in IDP3

[Hong Ye]

There wasn’t any error in the IDP log.  The only difference between IDP 3 response and IDP 2 response was the authenticationMethod in the SAML assertion. IDP use remote user authentication which hasn’t been changed. With IDP2, it return

<saml1:AuthenticationStatement AuthenticationInstant="2016-03-13T14:29:52.202Z"
                                       AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
                                       >

With IDP3, it return


        <saml1:AuthenticationStatement AuthenticationInstant="2016-03-13T14:10:23.350Z"
                                       AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified"


After IDP3 sent back SAML assertion, SP didn’t send backchannel query at all( I didn’t see it from access log). I guess maybe this SP only accept PasswordProtectedTransport authenticationMethod?

When RemoteUser is used, is "urn:oasis:names:tc:SAML:1.0:am:unspecified” the correct authenticationMethod to send back?


Thanks,
Hong


On Mar 13, 2016, at 12:45 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 3/13/16, 11:57 AM, "users on behalf of Tom Scavo" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of trscavo at gmail.com<mailto:trscavo at gmail.com>> wrote:



You have a single signing certificate in metadata that serves two
functions, that is, a SAML message signing certificate and a
back-channel TLS certificate. I believe IdP V3 is configured for
separate, distinct certificates out-of-the-box,

If you ignore the documentation and don't upgrade, yes.

so you need to figure
out how to configure V3 to use the same certificate for both purposes
(to match your metadata).

The IdP is not a web server, it's the web server that has a certificate configured for a second port. Even if the IdP generated one, it's the deployer that makes the decision which one to use.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160313/581da6c3/attachment.html>