SP: sending HTML form template to client

[Satheesh Kumar]

Just to confirm with above things Peter,  I have copied the
<IDPSSODescriptor> of two different IDP's below.

*IDP 1*
            <IDPSSODescriptor>
           <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://shibboleth.musc.edu/shibboleth-idp/profile/SAML2/POST/SSO"/>
           <SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="
https://shibboleth.musc.edu/shibboleth-idp/profile/Shibboleth/SSO"/>

 </IDPSSODescriptor>

* *we are missing redirect binding here

*IDP 2*

        <IDPSSODescriptor>

     <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://test.idp.com/idp3/profile/SAML2/POST/SSO
<https://cdc316-shibbolethidp.elsevier.com/idp3/profile/SAML2/POST/SSO>"/>

    <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="https://test.idp.com/idp3/profile/SAML2/POST-      SimpleSign/SSO
<https://cdc316-shibbolethidp.elsevier.com/idp3/profile/SAML2/POST-%C2%A0%C2%A0%C2%A0%C2%A0%C2%A0%20SimpleSign/SSO>
"/>

   <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://test.idp.com/idp3/profile/SAML2/Redirect/SSO
<https://cdc316-shibbolethidp.elsevier.com/idp3/profile/SAML2/Redirect/SSO>
"/>

   <SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="
https://test.idp.com/idp3/SSO
<https://cdc316-shibbolethidp.elsevier.com/idp3/SSO>"/>

</IDPSSODescriptor>

** we have redirect binding here.

These are the difference that tells SP, how to send messages to IDP.


Thanks,

Satheesh

On Mon, Sep 11, 2017 at 6:06 AM, Satheesh Kumar <satheeshvsbk at gmail.com>
wrote:

> Thanks Peter, It is clear now :)
>
> On Mon, Sep 11, 2017 at 5:33 AM, Peter Schober <peter.schober at univie.ac.at
> > wrote:
>
>> * Satheesh Kumar <satheeshvsbk at gmail.com> [2017-09-11 11:19]:
>> >      We have SP 2.6 and when sending <authnrequest> to one of our
>> > registered IDP, the attributes like "TARGET", "RelayState",
>> "SAMLRequest",
>> > "SAMLResponse", "SAMLart", "SigAlg"  are encoded within a form as hidden
>> > fields in "bindingTemplate.html" and the form is submitted along with
>> authn
>> > request. This is happening only for specific IDP's and I am not sure why
>> > this is happening.
>>
>> That's used when the SAML 2.0 Authentication Request (note the
>> html/head/title of the bindingTemplate.html) needs to be sent to the
>> IDP using the HTTP-POST protocol binding.
>>
>> Other IDPs may recieve authentication requests using the HTTP-Redirect
>> protocol binding.
>>
>> You can find the details of those bindings in the SAML Bindings spec,
>> e.g.:
>> https://www.oasis-open.org/committees/download.php/56779/sst
>> c-saml-bindings-errata-2.0-wd-06.pdf
>>
>> As to *why* the SP uses HTTP-POST one time and HTTP-Redirect another:
>> That depends on the bindings the IDP publishes in its SAML 2.0
>> Metadata.  The IDP recieving requests via HTTP-POST will likely only
>> announce support for HTTP-POST in its SingleSignOnService element.
>>
>> -peter
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> *Best wishes*,
> *Satheesh K*
>
>
>
>


-- 
*Best wishes*,
*Satheesh K*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170911/284a7b2a/attachment.html>