login failed for scitation.aip.org in IDP3

[Hong Ye]

Thanks Scott. I saw back channel SAML2 attribureQuery to port 8443 from other SP in the access log. Since SAML1 attributeQuery uses the same port, I think secure channel negotiation works. If SP sent it, I should see it in Apache access log. Right?


Hong

On Mar 13, 2016, at 1:58 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 3/13/16, 1:40 PM, "users on behalf of Hong Ye" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of hy93 at cornell.edu<mailto:hy93 at cornell.edu>> wrote:



With IDP2, it return
<saml1:AuthenticationStatement AuthenticationInstant="2016-03-13T14:29:52.202Z"
                                     AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
With IDP3, it return

That was a bug, the old IdP didn't prevent the misuse of SAML 2 contexts as SAML 1 methods.

      After IDP3 sent back SAML assertion, SP didn’t send backchannel query at all( I didn’t see it from access log).

That doesn't mean it didn't try and fail. Failure to negotiate a secure channel can't possibly show up in an application log behind the web server.

I guess maybe this SP only accept PasswordProtectedTransport authenticationMethod?

I doubt it.

When RemoteUser is used, is "urn:oasis:names:tc:SAML:1.0:am:unspecified” the correct authenticationMethod to send back?

You are responsible for configuring the values you want it to use. The values defined in SAML 1 are limited and you can find them in the original standard.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160313/ba0a2705/attachment.html>