Simple SAML

[Robert Lamothe]

Hi Peter,
    Sorry if I confused you.  When I asked for docs or websites I meant to increase my knowledge of Shibboleth.  A Shibboleth for dummies that assumes I know nothing but can take me through all the config files and explain what each does and why and how the components work.  I do refer to the docs on shibboleth.net but I find them very dry and have to drill down several layers as definitions rely on other definitions.  

       I understand SAML at the 50,000 foot level in how the SP redirects to the IDP, authenticates against the IDP, builds a token and returns it to the SP, but when I get into issues like this where there is more involved than just exchanging metadata and configuring an attribute filter I find myself crawling down rat holes.
    The forum is very helpful but I'd like to be able to come at it with a better understanding so I can be sure I'm asking the right questions.
Thanks-Bob --
Bob Lamothe
robert_lamothe at yahoo.com
KB1BOB
603-918-6336

 

    On Wednesday, June 20, 2018 5:48 AM, Peter Schober <peter.schober at univie.ac.at> wrote:
 

 * Thermal Reboot <thermalreboot at gmail.com> [2018-06-19 20:13]:
>    Yes, it is simplesamlphp.org, it's part of a Drupal setup.
> 
>    What can I advise them?  I've read that simplesaml.php supports SAML2
> and I'd thought that was the default.

By default SimpleSAMLphp will add both SAML1 and SAML2 endpoints from
imported SAML 2.0 Metadata, both when using the metarefresh[1] module
as well as using SSP's admin web UI (where you paste SAML 2.0 metadata
into a form and get back SSP's internal representation for use in its
config files).

Newer versions of metarefresh can also filter on SAML version, so you
could only import the SAML2 bits. Not knowing anything about the SP
there's not much to say here, it may not be using that way of
automatic importing, or it may not have configured protocol filtering,
or it may be using out-of-date software, or any one of other reasons.

If the SP hand-crafted the internal metadata (which simply consists of
nested PHP arrays) all bets are off, of course.

>    Can you recommend any websites or docs I might use to increase my
> understanding of these concepts?

There's not much to it and essentially everything I'd say here would
be off-topic on the Shibboleth list. The relevant docs[2] just mention
use of the admin UI or to hand-craft it. I've already mentioned
metarefresh, which has its own section in the docs and is not mention
here.

I guess it all boils down to how exactly they import or curate
metadata describing your IDP for/within SimpleSAMLphp.

If the software is picking SAML1 as the protocol it cannot possibly be
configured properly unless your own IDP's metadata only included SAML1
(which I cannot know and you don't say).

-peter

[1] https://simplesamlphp.org/docs/stable/simplesamlphp-automated_metadata
[2] https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_2
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180620/43174db0/attachment.html>