Please help reduce SAML 1 usage in the UK federation (was: SAML1.1 attribute release on Shib 3)

[Alex Stuart]

> On 17 Feb 2017, at 07:54, Rod Widdowson <rdw at steadingsoftware.com> wrote:
> 
>> because SPs use the WAYF protocol with our
>> Central Discovery Service; 
> 
> Doesn't that give you an obvious vector to get the people to put their houses in order?  Detect the shibboleth discovery requests
> which shouldn't be and react:

Absolutely.

> 
> (I'm assuming that the WUGen thingy no longer emits SAML1 references, but there is no doubt a backlog of references out there).

Actually, WUGEN does still produce SAML 1 links. It gives the "best" WAYFless URL it can, but we have a lot of SPs which don't have RequestInitiators in metadata & for which we don't have custom links, and so WUGEN falls back to the SAML 1 form. It does produce a measure of how good the link is, but it's not obvious to someone using the tool who will just cut-and-paste the provided link. 

So, yes, one could argue that WUGEN is contributing to prolonging SAML 1 usage in the UK federation. But portal pages need their WAYFless links, and so we also need to contact SP operators and ask them to provide good information to feed into WUGEN.


> 
> You should be able to detect in the CDS
> 
> - Shibboleth discovery protocol from an SP which doesn't support SAML1 - and let it go by
> - Shibboleth discovery protocol from an SP which does support SAML2 (via some suitable heuristics on the referrer)
> - Shibboleth discovery protocol from an "embedded URL" (ditto)
> 
> The last two bullets represent an organisation which has taken its eye off the ball.  How to deal with them, I'd leave to you, but
> for myself I'd create a suitable DS URL and throw up an interstitial page with some comment about "software out of date" or
> "referring link out of date" on the same page and add the link, inviting the user to click on it.
> 

Thanks. First thing would be for me to get numbers for each of those classes of interaction with the CDS.

> What I wouldn't do it automatically forward to the DS link - the user won't get exactly what they expect and needs to know why (or
> you'll get even more support calls), plus there has to be some pressure on the organization with the broken software.


Agreed. And one of the longer-term goals could be to set a date for turning off the WAYF protocol with the CDS. I haven't got a good feeling for whether that's politically possible, but it would be a way of signalling that SAML 1 is not welcome.

Alex

—
Alex Stuart
UK federation support team
alex.stuart at jisc.ac.uk



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3861 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170217/2ad41fea/attachment.p7s>