entityID format

[Matt MacAdam]

My standard lecture for someone who submits a non-standard EntityID is
as follows (usually we get folks submitting a URL without a scheme):
-----
This Entity ID doesn't conform to SAML standards, which specify that
the Entity ID should be a URI (which, if a URL, must include a
"scheme" like https:// at the beginning). Is it possible for you to
change it? A good alternative would be to add "https://" to the
beginning of the current EntityID.   I'm sorry we're asking after
you've already registered–we allow registration of non-conforming
EntityIDs for cases where we are integrating with a SAML provider that
doesn't implement the specification properly, but otherwise we require
that Entity IDs conform to SAML and InCommon guidelines.

The SAML specification discusses this in section 8.3.6:

https://www.oasis-open.org/committees/download.php/35711/sstc-saml-core-errata-2.0-wd-06-diff.pdf

And InCommon also publishes EntityID guidelines:

https://spaces.internet2.edu/x/eAUjAQ

If you're not using the Shibboleth SP software, let me know and we'll
evaluate an exception.
------
-----
Matt MacAdam
Software Engineer
UW Information Technology
206-616-9842


On Fri, Oct 7, 2016 at 6:59 AM, Rhys Smith <Rhys.Smith at jisc.ac.uk> wrote:
> On 7 Oct 2016, at 14:42, Mark K. Miller <max at psu.edu> wrote:
>>
>>> On 7 Oct 2016, at 07:30, Andrew Morgan <morgan at orst.edu> wrote:
>>>>
>>>> I'm on-boarding a new SP named "e-Builder".  They aren't members of InCommon, so they sent me their metadata.xml file directly.  It begins with:
>>>>
>>>> <md:EntityDescriptor ID="_mKch.03nGrlMcKptFQIJa8c6dg"
>>>> cacheDuration="PT1440M" entityID="sso.e-builder.net"
>>>> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>>>>
>>>> Is that an allowed entityID format?
>>>
>>> Nope.
>>
>> In my experience, though, it won't cause your IdP any problem at all.  Of course, my experience may only be referencing the v2 IdP, I'm not sure I've tried one of those with the v3 IdP.
>
> Oh yes, technically it won’t *break* anything. But it’s not good practice, and trying to register entityIDs like that on InCommon or the UK federation, or any other federation that knows what they’re doing, will result in a polite but firm rejection.
>
> If you’re doing things bilaterally with them, then it’s your decision. Many places have accepted this bad practice from Google and Microsoft - because they don’t have much choice in the matter. If you have any sway with the provider at all, however, definitely always try to get them to do it right before giving in.
>
> Rhys.
> —
> Dr Rhys Smith
> Chief Technical Architect, Trust & Identity
> Jisc
>
> T: +44 (0) 1235 822145
> M: +44 (0) 7968 087821
> Skype: rhys-smith
> GPG: 0x4638C985
> Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG
>
> jisc.ac.uk
>
> Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net