Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) :::

[Pruvost, Christian (ELS-OXF)]

Hello Everyone,



Thanks to all who provided answers.



Our SOAP binding issue got sorted finally. The IDP hadn't specified the correct port number and had left it on port 443. When they flipped that to port 9443, it all magically worked :)

It also means that you do not necessarily need a KeyDescriptor with a signing certificate for attributeQuery requests when you are using another port than 443 (e.g. 9443) and a simple certificate exchange to be able to perform the Attribute Query query request over a TLS (SSL) is working fine.



(...)

<md:AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

                                                <md:AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.domain:9443/idp/attrsvc.ssaml2"/>                                           <md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>

                <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

                                </md:AttributeAuthorityDescriptor>

(...)




I hope this can help others.



Cheers,

Christian.

________________________________________________________

Christian Pruvost

Technical Product Manager - Elsevier



-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: 27 November 2017 13:19
To: users at shibboleth.net
Subject: Re: Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) :::



*** External email: use caution ***







* Tom Scavo <trscavo at gmail.com<mailto:trscavo at gmail.com>> [2017-11-27 13:56]:

> > There's nothing stopping that now

>

> Well then I guess I didn't understand what you meant by "we're going

> to turn off the auto-querying functionality in 3.0?" If the SP emits a

> query, it needs a signing certificate in metadata, full stop.



You can comment out the SP's Handler/@type="AttributeQuery" today.



-peter

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

________________________________

Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171129/4019b349/attachment-0001.html>