Simple SAML

[Peter Schober]

* Robert Lamothe <robert_lamothe at yahoo.com> [2018-06-19 17:03]:
> I have an SP that is using Simple SAML

I only know SimpleSAMLphp, https://simplesamlphp.org/ are referring to
the same?

> the request they're sending looks like:
> 20180618T221641Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest|_2eb287de-083d-46b6-a94c-22d7f0295784|https://<site>/simplesaml/module.php/saml/sp/metadata.php/default-sp|http://shibboleth.net/ns/profiles/saml1/sso/browser|https://testshib.umassmed.edu/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_8c86f56ccf6afcc11b6713b4018da767|svcdrupalldap|urn:oasis:names:tc:SAML:1.0:am:password||AAlzZWNyZXQ4OTBdYyK5C5kwrxXkJHY/UWv7sVFG+W+grJzI4We1r52pSwE4q4hgvlChfr93GbG3Vf1G5fpPo8dr5NY0Lars/454QTzLexdP7Y1IIgqYM2Hn77n2u/7YY3g2V9ugIF6XDzWYqZyouKApz2OdSeZQYpu1xWSmjHzYmAomFzGe3Qsz4Y4eMiOHJEPvUHSYCkBeKXX4roto4GA=|_27827180a700e2846aaa90126dd5dc8d|

Well, not a SAML request (but the IDP's audit log) but it should
suffice to determine that the SP us using the old, proprietary
Shibboleth-style request for SAML1.
There should be no need to do that, SimpleSAMLphp has support SAML2.0
since the early days.

> All the other SPs I work with submit HTTP-POST which I believe is default for Shibboleth.

Not for requests, no. saml2int 0.2 even says the request MUST be using
the HTTP-Redirect prococol binding.

> I believe this is generated by the SP, but they keep pushing it back
> in my lap.  Is there something I can do on the IDP to insure their
> request is HTTP-POST?

No, by definition, except you have pre-historic SAML metadata that
doesn't include endpoints with SAML2 bindings.

-peter