Communicate with SP: Am I going Mad?

[Peter Schober]

* Kevin Ratcliffe <kratcliffe at bolton-sfc.ac.uk> [2016-09-26 16:59]:
> I am trying to communicate with a SP, but the only information that
> they will give me is at the link below.
> 
> http://resources.microlibrarian.net/management/WebHelp/en/index.htm?context=1900
> 
> No mention of metadata or entityId as far as I can see.

Challenging. You can mint some metadata for their SP, including trying
any entityID value that makes sense to you (they likely won't even
check whether they are the specified recipient).

*But* you'd still need the ACS URLs where the IDP should send SAML
protocol messages to. You can't make that up and there's nothing on
that page that would give a hint. If you manage to get a SAML 2.0
Authentication Request out of that system you can trace the SAML in
the browser (Firefox's SAML Tracer extension makes that trivial) and
hopefully there's an ACS URL the SP expects the response to be sent
to. Maybe. Otherwise that's the end of the story, the IDP needs to
know where to send the reponse.

For attributes ("Matching field") it's completely unclear what those
fields map to on the wire (formal attribute names or even
"FriendlyName"). The "SSO Login Page URL" possibly is your IDP's SSO
endpoint as per its own metadata (trace HTTP in the browser to find
out what binding the SP tries to use for the request, Redirect or
POST). And you can create an SP key pair (with openssl or whatever)
and try uploading some part of it to their UI (but a "certificate" and
a "passwort" don't make any sense; maybe try a password-proteced
private and the matching password). Lots of guesswork involved, no
doubt. Try without any of the SP cert stuff first. Given the rest of
the info it's highly doubtful they even support encryption.

The "Identity Provider Certificate Encryption Password" I have no idea
about, sorry. And it doesn't ask for a certificate from the IDP (so
it's not about validating the IDP's signature to make sure the data
sent is authentic). That all does not sound good, in any case. 8-\

An SP that's known to not care about where it recieves assertions from
is not an SP you'd want to expose even on your internal network (let
alone over the Internet).

> Their support have no idea about Shibboleth and claim that I am the
> only customer that wants to use it. Am I getting stupider or, as far
> as their documentation goes, is it impossible to communicate with
> their SP?

I sure hope neither, but it doesn't look good (even though they made a
GUI for it and even wrote "documentation").

Try getting an authn request generated, that might shed light on what
the SP calls itself and where it wants reponses to be sent.
Otherwise make up the entityID and play with NameID formats or
attribute names.
If it only supports IDP-initated you're screwed unless you can find
out to what URL to send responses.
-peter