users Digest, Vol 73, Issue 110

[Cheltenham, Chris]

John.

If I may interject. You really do not want to get into a habit of rigging
things to work because the other side is not up to speed on SMAL.

Gently push back and show them where they are worn g and I think they will
appreciate it and respect your knowledge as well.


===========================

Thank You;

Chris Cheltenham
Technology Services
The School District of Philadelphia

Work # 215-400-5025
Cell # 215-301-6571 

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of
users-request at shibboleth.net
Sent: Friday, July 21, 2017 1:53 PM
To: users at shibboleth.net
Subject: users Digest, Vol 73, Issue 110

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than
"Re: Contents of users digest..."


Today's Topics:

   1. Re: Interaction between Shib and basic (file) authn in Apache
      2.4 (Cantor, Scott)
   2. Re: override ProtocolBinding in authnRequest (Cantor, Scott)


----------------------------------------------------------------------

Message: 1
Date: Fri, 21 Jul 2017 17:47:41 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: Interaction between Shib and basic (file) authn in Apache
	2.4
Message-ID: <B7372CBA-5295-4A09-9086-41FE7E0B091F at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 7/21/17, 12:13 PM, "users on behalf of Chris Reeves"
<users-bounces at shibboleth.net on behalf of chris.reeves at york.ac.uk> wrote:

> would 2.6.0 (or 2.5.2) w/ Apache 2.2 require ShibCompatValidUser?

No.

> I'm happy to make edits to clarify if you can confirm that this is 
> only required when mod_shib is running inside Apache 2.4 (which sounds 
> like it is probalby the case).

I'm not sure the command is even supported on 2.2. I seem to recall
somebody noting that as a problem and wishing it was no-op'd there, and I
agreed at the time that I had probably made a mistake there.

-- Scott



------------------------------

Message: 2
Date: Fri, 21 Jul 2017 17:53:15 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: override ProtocolBinding in authnRequest
Message-ID: <3F580A44-A828-4FF1-96DB-FE7CC7A9466A at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 7/21/17, 1:30 PM, "users on behalf of John Schrader"
<users-bounces at shibboleth.net on behalf of John.Schrader at nd.edu> wrote:

> Is there a way to override the ProtocolBinding being supplied in an
AuthnRequest?
> We have a vendor that is sending
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
> but expecting: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

If you want to avoid a bug in the requests issued by the SP, which I would
simply report and wait for them to fix, generally a simple way is to take
advantage of the meaninglessness of most SP requests, and funnel them
through a facade script on the server that just redirects through the
IdP's Unsolicited SSO endpoint, essentially bypassing the request. You can
still maintain the RelayState in doing that.

If you really want to override it, it requires Java code and the authoring
of a Spring WebFlow. I would not suggest that level of effort.

-- Scott



------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 73, Issue 110
**************************************