BannerXE, unscoped entityid

[Jeffrey Crawford]

Greetings,

We are trying to get BannerXE to work with SAML. It appears that they don't
have a concept of using a url like name for the entityID. Because the
entityID mush match part of the URL for the postback URL

for example they use the following example:
<EntityDescriptor
        ID="<ALIAS>"
        entityID="<ALIAS>"
        xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
        xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
.
.
.
              <AssertionConsumerService
                    isDefault="true"
                    index="0"
                    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Location="
https://bsg-dev-ban-1.ucsc.edu:8445/applicationNavigator/saml/SSO/alias/
<ALIAS>"/>
              <AssertionConsumerService
                    index="1"

Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                    Location="
https://bsg-dev-ban-1.ucsc.edu:8445/applicationNavigator/saml/SSO/alias/
<ALIAS>"/>

If we follow the example this is what the metadata must look like if we try
to scope the entityID
<EntityDescriptor
        ID="https://host.domain/sp/service/"
        entityID="https://host.domain/sp/service/"
        xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
        xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
.
.
.
              <AssertionConsumerService
                    isDefault="true"
                    index="0"
                    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Location="
https://bsg-dev-ban-1.ucsc.edu:8445/applicationNavigator/saml/SSO/alias/
https://host.domain/sp/service/"/>
              <AssertionConsumerService
                    index="1"

Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                    Location="
https://bsg-dev-ban-1.ucsc.edu:8445/applicationNavigator/saml/SSO/alias/
https://host.domain/sp/service/"/>


Obviously the AssertionConsumerService can't have another https://
somewhere in the url. How bad is it to actually have an entityID in our
local metadata that is not scoped so entityID="service" instead of
entityID="https://host.domain/sp/service/" There appears to be no way to
convince the SP that the entityID should look like a url, it has to be a
short name.

This would not be able to be in the InCommon metadata obviously, but could
we run into trouble otherwise?


Jeffrey E. Crawford
Enterprise Service Team <jeffreyc at ucsc.edu>

Both pilots and IT professionals require training and currency before
charging into clouds!
---------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161121/14ba0452/attachment.html>