SAManage with Shibboleth 3?

[Tom Scavo]

On Wed, Apr 18, 2018 at 9:35 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Mark Cairney <Mark.Cairney at ed.ac.uk> [2018-04-18 14:25]:
>> My final relying-party.xml config is:
>>
>>     <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
>>       <property name="profileConfigurations">
>>         <list>
>>           <bean parent="SAML2.SSO" p:encryptNameIDs="never"
>> p:encryptAssertions="never"
>> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
>>         </list>
>>       </property>
>>     </bean>
>>
>> This isn't wildly different from the original config I had in place
>
> Which is why my earlier comment about nameIDFormatPrecedence still
> applies. (TL;DR: Put it in metadata instead.)

Yes, I agree, put it in the metadata, but let's back up a bit. Mark,
in your original post, you said you're using a
FilesystemMetadataProvider on a snapshot of SP metadata. I wonder why
you did it that way?

Looking at the external doc you provided earlier, [1] I see that SP
metadata can be retrieved via HTTPS. Is that correct? If so, you might
want to do the following:

1. Configure a FileBackedHTTPMetadataProvider [2]
2. Add a NameIDFormat filter [3]
3. Add a Predicate filter [4]

The latter is used to limit metadata to a single SP, that is, your SP
and no others.

Hope this helps,

Tom

[1] https://community.samanage.com/message/6116
[2] https://wiki.shibboleth.net/confluence/x/kQInAQ
[3] https://wiki.shibboleth.net/confluence/x/bwCIAQ
[4] https://wiki.shibboleth.net/confluence/x/aAAzAQ