Manually Generate a SAML Response

[Domingues, Michael D]

Replying publicly for the sake of others (removing specific names and details to protect the innocent and not-as-innocent):


The approach that we took, generally, was to push back hard (email, and then a conference call) on their self-test requirements, along with the fact that they only supported IdP-initiated SSO at the time.


I expressed significant concerns that the peculiarities of their implementation would lead to poor interoperability and increase their cost-to-integrate in the education space, citing relevant InCommon, Shibboleth, and OASIS SAML documentation when relevant. We offered to, and then helped them prove-out their SP-initiated SSO configuration.


> I would SO love to do that .  Unfortunately, the vendor says "no, you have to do it this way".  The department that wants

> this SSO connection goes to my boss and my boss  says "do it".  I would really like to get to a point where I can make

> some of these SPs jump through arbitrary "hoops", just because I feel like it.


As an aside, I generally find that as long as you phrase things in terms of "this will make the integration more stable / reliable" to your institution, and "this will make adding new customers easier / cheaper" to vendors, you get a fair deal of leeway to push vendors toward best practices. Your mileage may vary.


If they're trying to get you (or any other people on the list who might be working with them) to set this up as an IdP-initiated integration, I'd at the very least draw a firm line on that and require them to go to SP-initiated. They're fully capable of doing it, feel free to let them know that you know other customers are using it.


Other than that, everything was pretty vanilla. We don't even have a specific relying-party entry for them; the out-of-the-box IdPv3 defaults work fine.


Michael

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Michael Dahlberg <olgamirth at gmail.com>
Sent: Wednesday, June 21, 2017 2:04:08 PM
To: Shib Users
Subject: Re: Manually Generate a SAML Response

Thank you all very much for your assistance.

Nate:

Its not the actual AuthnRequest that I'm trying to generate but the SAML response once the AuthnRequest is complete

Scott:

That worked ... or at least the SAML response wasn't returned.  Thanks!

Peter:

I would SO love to do that .  Unfortunately, the vendor says "no, you have to do it this way".  The department that wants this SSO connection goes to my boss and my boss says "do it".  I would really like to get to a point where I can make some of these SPs jump through arbitrary "hoops", just because I feel like it.

Michael:

You are correct.

Thanks again,
Mike

On Wed, Jun 21, 2017 at 8:56 AM, Domingues, Michael D <michael-domingues at uiowa.edu<mailto:michael-domingues at uiowa.edu>> wrote:

Based on the phrasing of the initial request, I'm about 90% confident that the vendor in question here is Photoshelter. If that's indeed the case, when integrating with them, we had success at Iowa by pushing back and insisting that they enable SP-initiated SSO and test things in the conventional manner.


Michael, if this is the case, feel free to contact me off-list and I can provide some more details.

________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Peter Schober <peter.schober at univie.ac.at<mailto:peter.schober at univie.ac.at>>
Sent: Wednesday, June 21, 2017 5:45:56 AM
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Re: Manually Generate a SAML Response

* Michael Dahlberg <olgamirth at gmail.com<mailto:olgamirth at gmail.com>> [2017-06-20 22:26]:
> I have what I think is a unique problem.  I'm working with a SP that wants
> to validate our IdP.  In so doing, they want us to POST a web document to
> their test site which contains three fields: a base64 encoded SAML2
> response, the base64 encoded version of our Shibboleth X509 cert, and our
> entityId.

Maybe just ask them to stop being silly, support SAML 2.0 Metadata (to
learn your IDP's cert, among other things) and provide a way to
actually test logins to their SP using your IDP, then they'll get all
that anyway. Just a thought.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/f1310f62/attachment-0001.html>