Educause SP login

[Domingues, Michael D]

I've managed to replicate this behavior. Starting from educause.edu, I clicked the login link, then "Log In Using InCommon", then selected my IdP from their WAYF service.

I'm not familiar with the intricacies of how the Ping SP operates, but upon selecting my IdP in the WAYF service, it issues a GET request to:

https://sso.educause.edu/sp/startSSO.ping?PartnerIdpId=urn:mace:incommon:uiowa.edu&TargetResource=https%3a%2f%2fsso.educause.edu%2fidp%2fstartSSO.ping%3fPartnerSpId%3dhttps%3a%2f%2fwww.educause.edu%2fshibboleth-sp%26IdpAdapterId%3dOpenTokenIdpAdapter%26TargetResource%3dhttps%3a%2f%2fwww.educause.edu%2fshib_login%2fhome%3fq%3dnode%2f248116

This, in turn, redirects and tries to POST to:

https://sso.educause.edu/idp/profile/SAML2/POST/SSO

With a SAML AuthnRequest. Like Scott said earlier, it's an incorrect relative redirect, which leads to the 404. Vendor problem. Though, given the entityID change (which wasn't announced to us), this wouldn't have worked this morning for us regardless. Time to update the config.

Michael Domingues
Directory and Authentication Services
University of Iowa

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, March 14, 2016 7:06 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Educause SP login

On 3/14/16, 7:59 PM, "users on behalf of Michael Dahlberg" <users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:


>
>They changed their entityId?!  I was not aware of this.  We certainly haven’t changed the attributes that we release to the entityId

It didn't change how I used it, I just went to educause.edu per usual. But yes, when they dumped Shibboleth and went to Ping, they changed their entityID, thus embodying more irony than one brain can hold.

>https://www.educause.edu/shibboleth-sp
>
>Is this the entityId you use?  I did check in the InCommon feed and that entityId is listed.

Is it? No, that's the old one, so uh...hmm, no comment.

The new one is "https://sso.educause.edu/sp" and when I accessed it, that was the requesting identity, so I had to change the policy I had (we don't release affiliation by default, I just don't like systems using affiliation unless I know how they're using it).

But that doesn't explain a 404. Are you still getting it? Where are you starting from?

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net