ArcGIS metadata - no certificate

[Wessel, Keith]

It's possible, at least for some versions of ArcGIS, to have an SP certificate. I know that for our implementation here, we have a certificate in their SP metadata for both signing and encryption, but I suspect it's optional in the software's SAML setup.

Also note that they have the weirdness of requiring a name identifier of type unspecified, meaning they actually want the name identifier to be of that format rather than the intended meaning of they'll accept any name ID.


They also want the assertion to be signed. So, you'll need to configure that in your relying party config.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Scott Koranda
Sent: Friday, September 08, 2017 9:52 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: ArcGIS metadata - no certificate

> Hi all,
> 
> Quick question: I read the very helpful discussions in a 2015 email about
> configuring this thing with IdP v3 (and yes, they still expect "givenname" to
> have the full name in it O_o. But I have a more basic problem: the metadata
> generated by their SP config page (given to me by the staff person who set it
> up) has no certificate.
> 
> So, is that user error on his part? Or did you all get it working without an SP
> certificate? I thought having no certificate was kind of a deal breaker, though
> I guess you could say 'don't sign anything'?

The SP certificate is not used to sign the assertion sent by your IdP.
Your IdP signing certificate is used for that.

The SP certificate would be used for encrypting the assertion sent by
your IdP. If you do not have an SP certificate than your IdP cannot and
is not encrypting any assertion it sends to that SP. 

The SP certificate would also be used to check a signed authentication
request from the SP if it sent one. It probably is not and it is
unlikely your IdP would require it.

Provided you accept the risk to send an un-encrypted assertion to the SP
you most likely do not need the SP certificate.

Scott K
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net