Simple SAML

[Thermal Reboot]

Hi Peter,

    Yes, it is simplesamlphp.org, it's part of a Drupal setup.

    What can I advise them?  I've read that simplesaml.php supports SAML2
and I'd thought that was the default.

    Can you recommend any websites or docs I might use to increase my
understanding of these concepts?

Thanks
-Bob

On Tue, Jun 19, 2018 at 12:16 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Robert Lamothe <robert_lamothe at yahoo.com> [2018-06-19 17:03]:
> > I have an SP that is using Simple SAML
>
> I only know SimpleSAMLphp, https://simplesamlphp.org/ are referring to
> the same?
>
> > the request they're sending looks like:
> > 20180618T221641Z|urn:mace:shibboleth:1.0:profiles:
> AuthnRequest|_2eb287de-083d-46b6-a94c-22d7f0295784|https:/
> /<site>/simplesaml/module.php/saml/sp/metadata.php/default-sp|
> http://shibboleth.net/ns/profiles/saml1/sso/browser|
> https://testshib.umassmed.edu/idp/shibboleth|urn:oasis:
> names:tc:SAML:1.0:profiles:browser-post|_8c86f56ccf6afcc11b6713b4018da7
> 67|svcdrupalldap|urn:oasis:names:tc:SAML:1.0:am:password||
> AAlzZWNyZXQ4OTBdYyK5C5kwrxXkJHY/UWv7sVFG+W+grJzI4We1r52pSwE4q4hgvlChfr93G
> bG3Vf1G5fpPo8dr5NY0Lars/454QTzLexdP7Y1IIgqYM2Hn77n2u/
> 7YY3g2V9ugIF6XDzWYqZyouKApz2OdSeZQYpu1xWSmjHzYmAomFzGe3Qsz4Y
> 4eMiOHJEPvUHSYCkBeKXX4roto4GA=|_27827180a700e2846aaa90126dd5dc8d|
>
> Well, not a SAML request (but the IDP's audit log) but it should
> suffice to determine that the SP us using the old, proprietary
> Shibboleth-style request for SAML1.
> There should be no need to do that, SimpleSAMLphp has support SAML2.0
> since the early days.
>
> > All the other SPs I work with submit HTTP-POST which I believe is
> default for Shibboleth.
>
> Not for requests, no. saml2int 0.2 even says the request MUST be using
> the HTTP-Redirect prococol binding.
>
> > I believe this is generated by the SP, but they keep pushing it back
> > in my lap.  Is there something I can do on the IDP to insure their
> > request is HTTP-POST?
>
> No, by definition, except you have pre-historic SAML metadata that
> doesn't include endpoints with SAML2 bindings.
>
> -peter
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180619/0b883d7e/attachment.html>