unable to capture eppn information from SAML2/POST at SP

[John Dennis]

On 06/11/2018 06:35 PM, Cantor, Scott wrote:
> On 6/11/18, 6:29 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:
> 
>> BTW, Much of the documentation I am reading out there seems to imply that the configuration is being done by 'one'
>> entity with access to "both" IdP and SP configurations and logs simultaneously.
> 
> What I said notwithstanding, certainly it is true that it's impossible  to test and operate an SP effectively without an IdP, and if you don't control *an* IdP, you will pay for it. That doesn't imply you control every IdP you work with, but if you try and run an SP without one, you'll fail in various ways eventually simply due to lack of robust testing. SSO systems have two halves and you either run both or you eventually pay for it in reliability. You can't wish that need away.
> 
> (The best choice of a simple one-off IdP is not something I can really answer. I doubt a Shibboleth IdP is a good choice for most as it's more than one would need, but I don't have to answer that question since my primary OSU role is running one, so my gap these days is the opposite, having control over SPs to test with.)

Ipsilon is a relatively simple IdP to set up. You can run a test 
instance of Ipsilson from a Git clone, using the quickrun.py script.
https://pagure.io/ipsilon

There is also Keycloak, not as simple as Ipsilon but not overly 
difficult. https://www.keycloak.org/

Unfortunately SAML is one of those technologies you need to have a 
reasonable understanding of before you start trying to deploy it. If you 
don't invest some time in learning the core concepts you'll frustrate 
yourself, take it from someone who learned that lesson the hard way. I'm 
going to guess others on this list might agree. To that end a good 
introduction is the SAML Technical Overview published by OASIS, the body 
that controls the SAML specs.

https://www.oasis-open.org/committees/download.php/27819/sstc-saml-tech-overview-2.0-cd-02.pdf

Also don't be afraid to read the various specs, there is good 
information in them:

https://docs.oasis-open.org/security/saml/v2.0/


-- 
John Dennis