Simple SAML

[Peter Schober]

* Thermal Reboot <thermalreboot at gmail.com> [2018-06-19 20:13]:
>     Yes, it is simplesamlphp.org, it's part of a Drupal setup.
> 
>     What can I advise them?  I've read that simplesaml.php supports SAML2
> and I'd thought that was the default.

By default SimpleSAMLphp will add both SAML1 and SAML2 endpoints from
imported SAML 2.0 Metadata, both when using the metarefresh[1] module
as well as using SSP's admin web UI (where you paste SAML 2.0 metadata
into a form and get back SSP's internal representation for use in its
config files).

Newer versions of metarefresh can also filter on SAML version, so you
could only import the SAML2 bits. Not knowing anything about the SP
there's not much to say here, it may not be using that way of
automatic importing, or it may not have configured protocol filtering,
or it may be using out-of-date software, or any one of other reasons.

If the SP hand-crafted the internal metadata (which simply consists of
nested PHP arrays) all bets are off, of course.

>     Can you recommend any websites or docs I might use to increase my
> understanding of these concepts?

There's not much to it and essentially everything I'd say here would
be off-topic on the Shibboleth list. The relevant docs[2] just mention
use of the admin UI or to hand-craft it. I've already mentioned
metarefresh, which has its own section in the docs and is not mention
here.

I guess it all boils down to how exactly they import or curate
metadata describing your IDP for/within SimpleSAMLphp.

If the software is picking SAML1 as the protocol it cannot possibly be
configured properly unless your own IDP's metadata only included SAML1
(which I cannot know and you don't say).

-peter

[1] https://simplesamlphp.org/docs/stable/simplesamlphp-automated_metadata
[2] https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_2