SAML2 Support Listed In Metadata

[Reynolds, Jeffrey]

Hi everybody,

I’ve got two questions, one of which I probably already know the answer to (though having confirmation would be helpful).

Our institution is in the process of upgrading from IdP v2 to v3, and I had a question about configuring multiple LDAP data connectors.  I’ve seen that one difference between v2 and v3 is that there is an ldap.properties file which appears to expose more of the advanced LDAP options.  But this setup seems to only allow for a single LDAP data connector (note I’m trying to connect to two different directories, not multiple nodes of a single directory).  I’m assuming that I can define DataConnector elements in v3 like I could in V2 (ignoring the ldap.properites file if I specify those values directly in the attribute-resolver), but is this the intended way to do this, or is there another option to either define multiple servers in a single properties file, or have multiple files?

Second, and I think I know the answer to this but I have to ask, if we declare that we support “urn:oasis:names:tc:SAML:2.0:protocol” in our metadata file does this mean we also have to support artifact resolution?  We currently don’t have any service providers that utilize artifact resolution, and we would like to officially drop support of it, at least until we get a chance to but some more planning into our load balancing architecture.  Of course, one of the objectives of this upgrade is to clean up our deployment, so if it’s a requirement we’ll definitely work it in.

Thanks for any guidance on these issues.  Though I’m not as knowledgeable in Shibboleth and SAML as I’d like to be, I’m looking forward to this upgrade as an opportunity to become more compliant with the standards and have a better working setup.

Much obliged,

Jeff Reynolds
Senior Information Security Analyst
972-883-6828 | jreynolds at utdallas.edu<mailto:jreynolds at utdallas.edu>
Information Security Office<http://secure-web.cisco.com/1afCCmPALdg8YuA9L0O0t06wOtg6oUwOf27frULVxl6D4hz3F7rZiqOAtTpcdN-LobE-ckT8015ydA9aER611c1CaVtBbMu4_EzfGwuF8zFkhgoZM9QwUYSqIy3pOsTWpensz7zUmLNEusIrRmGqLcgQcptLIzVCi8_pjvs1ZkDmomfcOt0-qeYGcJSbQbyeM/http%3A%2F%2Fwww.utdallas.edu%2Finfosecurity%2F>
The University of Texas at Dallas<http://secure-web.cisco.com/1Cpl8ttBT6ZGunfGnpHes_P09cbe-u9TknUQoTtH8s3Ib-Ksf7gQk5OG94tS227GNQbJLBle-3By0cQFZqCpbyjy0R5KsrPm_kyk0Q2ThKqeUPqC8h8o5S7XzFjmiqcpFGbFJZYFaOEBfrw98cKcOqV5QIX1jYsZU39sP_RwaCn7puMfiQYtPpGdOe3HFtHqX/http%3A%2F%2Fwww.utdallas.edu%2F>
<http://secure-web.cisco.com/1szYsJ4dNTeYEjpBFxN7WspaYjrR3ILWtiKtLTUNMu_zh_MDZZy2vcPCK-nj_pPyvg2lhG-lX3dz1cGHhoGnRxvq5WBK81YXv7CMTwxa28zxJ_J87QKVu6IThqP-wobIbl6adOD-Iaal04Q4v5lqpOopinaROydDyGogSKFgtXcbqa3Sv5mU_CcLY2LvE5K-e/http%3A%2F%2Futdallas.parature.com%2F>[X]<http://secure-web.cisco.com/1szYsJ4dNTeYEjpBFxN7WspaYjrR3ILWtiKtLTUNMu_zh_MDZZy2vcPCK-nj_pPyvg2lhG-lX3dz1cGHhoGnRxvq5WBK81YXv7CMTwxa28zxJ_J87QKVu6IThqP-wobIbl6adOD-Iaal04Q4v5lqpOopinaROydDyGogSKFgtXcbqa3Sv5mU_CcLY2LvE5K-e/http%3A%2F%2Futdallas.parature.com%2F><http://secure-web.cisco.com/1szYsJ4dNTeYEjpBFxN7WspaYjrR3ILWtiKtLTUNMu_zh_MDZZy2vcPCK-nj_pPyvg2lhG-lX3dz1cGHhoGnRxvq5WBK81YXv7CMTwxa28zxJ_J87QKVu6IThqP-wobIbl6adOD-Iaal04Q4v5lqpOopinaROydDyGogSKFgtXcbqa3Sv5mU_CcLY2LvE5K-e/http%3A%2F%2Futdallas.parature.com%2F>





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160519/feecfd04/attachment-0001.html>