SAManage with Shibboleth 3?

[Tom Scavo]

On Wed, Apr 18, 2018 at 11:28 AM, Mark Cairney <Mark.Cairney at ed.ac.uk> wrote:
>
> The point about key rollover is moot in this case as their metadata has
> no keys

Right, that makes their metadata dead simple.

> and I've had to manually hack the endpoint URLs in the metadata
> to work around an issue with how their website is hosted.

There is only one endpoint location that I can see but are you saying
that the endpoint in the online metadata is different than the
endpoint(s) in the snapshot metadata in the file system? Why is that?

> The downloaded metadata already contains a NameIDFormat element:
>
>   <md:NameIDFormat>
>    urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
>   </md:NameIDFormat>

Then that should Just Work (TM). Looking at the SAML assertion you
posted previously, it appears to work just fine, so I'm not sure what
the problem is.

> I do like the look of the NameIDFormatFilter and Predicate filter
> although I note that this is new functionality.

Apparently you don't need a NameIDFormat filter since the desired
NameIDFormat is already in the metadata. In any case, since you've
already configured a FilesystemMetadataProvider, you may want to stick
with that for the time being. Once your integration is complete, I'll
go back and try to address Scott's concerns about using a
FileBackedHTTPMetadataProvider.

Tom