AW: Signing of assertions

[Roehrl Patrick]

>You have to be processing those requests as different relying party configurations, which means the two cases are being handled as different entityIDs, different metadata, etc. Until you fix that, the rest is academic. Probably the initial launch is IdP initiated and the other SP-initiated, and the entityIDs have to be different in each case.

Both AuthRequests are SP-initiated. But at the moment I don't understand why I have to use two different entityIDs...it's the same SP and for the SP it's the same situation...in both cases the user has no session --> send a AuthnRequest to IdP....This would mean, that our SP has to know if the user's SSO session at the IdP is still valid. If it's valid it has to use this entityId and if not the other entityId... Really?
With IdP V2.x this was no problem...

> My second guess is that this is so screwed up you're mixing SAML versions on top of everything else.
We're using SAML2 for requests and responses.

>You have one completely fubar situation. Fix that, and the rest will fix itself.

-- Scott
    
    

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net