Login Authentication page for shibboleth IDP

[Peter Schober]

* Santu Ghosh <mon.snahasish at gmail.com> [2017-11-23 14:36]:
> Most probably I found the problem (but not sure). My IDP is not
> signed but my SP is signed *(AuthnRequestsSigned="true" )*.

That doesn't mean "your SP is signed" and it has nothing to do with
signing metadata. The issue here seems to be that the SP's metadata is
telling the IDP that it (the SP) will always sign its SAML2.0
authentication requests.
That doesn't work (as you've seen) with proprietary authentication
requests, as these are not (and cannot be) signed.

> 1) If SP metadata is signed and IDP metadata is not signed, then
> unsolicited SSO will not work.

Incorrect.

> 2) If SP metadata is signed and IDP metadata is not signed, then SP
> initiated SSO will work.

Not relevant to whether SP-initiated SSO will work.
The IDP needs metadata for the SP. If it trusts unsigned metadata (by
you giving it unsigned metadata and not putting a filter on it that
requires a signature) then it will trust unsigned metadata.

> 3)If SP metadata is signed and IDP metadata is also signed, then
> unsolicited SSO will work.

Not relevant, as above. Proprietary SSO requests cannot work if the SP
itself states that its requests will be signed.

> Another question is, after successful login (unsolicited SSO) I got
> only uid as my return attribute list.

I'd suggest opening another thread for attribute release issues.
But before that look at your IDP process log which will tell you what
it releases (or not). On DEBUG it will also tell you wh exactly and
for each attribute.

-peter