Communicate with SP: Am I going Mad?

[Kevin Ratcliffe]

Thanks Scott,  Peter

I think I'll give Shibboleth a miss with this SP. This is a bit beyond me

________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: 26 September 2016 16:34
To: users at shibboleth.net
Subject: Re: Communicate with SP: Am I going Mad?

* Kevin Ratcliffe <kratcliffe at bolton-sfc.ac.uk> [2016-09-26 16:59]:
> I am trying to communicate with a SP, but the only information that
> they will give me is at the link below.
>
> http://resources.microlibrarian.net/management/WebHelp/en/index.htm?context=1900
>
> No mention of metadata or entityId as far as I can see.

Challenging. You can mint some metadata for their SP, including trying
any entityID value that makes sense to you (they likely won't even
check whether they are the specified recipient).

*But* you'd still need the ACS URLs where the IDP should send SAML
protocol messages to. You can't make that up and there's nothing on
that page that would give a hint. If you manage to get a SAML 2.0
Authentication Request out of that system you can trace the SAML in
the browser (Firefox's SAML Tracer extension makes that trivial) and
hopefully there's an ACS URL the SP expects the response to be sent
to. Maybe. Otherwise that's the end of the story, the IDP needs to
know where to send the reponse.

For attributes ("Matching field") it's completely unclear what those
fields map to on the wire (formal attribute names or even
"FriendlyName"). The "SSO Login Page URL" possibly is your IDP's SSO
endpoint as per its own metadata (trace HTTP in the browser to find
out what binding the SP tries to use for the request, Redirect or
POST). And you can create an SP key pair (with openssl or whatever)
and try uploading some part of it to their UI (but a "certificate" and
a "passwort" don't make any sense; maybe try a password-proteced
private and the matching password). Lots of guesswork involved, no
doubt. Try without any of the SP cert stuff first. Given the rest of
the info it's highly doubtful they even support encryption.

The "Identity Provider Certificate Encryption Password" I have no idea
about, sorry. And it doesn't ask for a certificate from the IDP (so
it's not about validating the IDP's signature to make sure the data
sent is authentic). That all does not sound good, in any case. 8-\

An SP that's known to not care about where it recieves assertions from
is not an SP you'd want to expose even on your internal network (let
alone over the Internet).

> Their support have no idea about Shibboleth and claim that I am the
> only customer that wants to use it. Am I getting stupider or, as far
> as their documentation goes, is it impossible to communicate with
> their SP?

I sure hope neither, but it doesn't look good (even though they made a
GUI for it and even wrote "documentation").

Try getting an authn request generated, that might shed light on what
the SP calls itself and where it wants reponses to be sent.
Otherwise make up the entityID and play with NameID formats or
attribute names.
If it only supports IDP-initated you're screwed unless you can find
out to what URL to send responses.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This email has been scanned by BSFC and seems to be OK

This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual(s) to whom it is addressed. If you receive this email by mistake please notify the sender and delete it immediately. This communication represents the originator's personal views and opinions which do not necessarily represent those of Bolton Sixth Form College.