Configuring Shibboleth v3 IdP for Unsolicited SSO (IdP Initiated SSO)

[Timothy Enders]

Hi all:

Following up on this discussion from several weeks ago when Nate Klingenstein was so helpful with an UnsolicitedSSO config issue I was having. I have returned to working on this, and can't get it figured out. I'm not sure at this point if the metadata from the SP is malformatted or incomplete, or if I'm doing something wrong. I was hoping that one of you could lend a hand. As last time, I apologize if I'm asking basic or silly questions - I was handed this system out of the blue and don't have a ton of experience with it.

Example of metadata (I have to insert spaces in the URLs throughout this email, or MS Safelinks will garble it:

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
                     validUntil="2018-05-13T20:34:25Z"
                     cacheDuration="PT604800S"
                     entityID="ExampleCom">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                     Location="https:// example. Example .com/example /layoutscripts/Cpal_SSO_AssertionConsumerService.aspx"
                                     index="1" />
        
    </md:SPSSODescriptor>
</md:EntityDescriptor>


I have this metadata in %idphome%\metadata in a file called example.xml
I realize that the "validUntil" date has long been passed, but I'm not sure that's the root issue, though I am following up with the vendor on it.

I have edited relying-party.xml to add the following:


<bean parent="RelyingPartyByName" c:relyingPartyIds="ExampleCom">	
            <property name="profileConfigurations">
                <list>
					<bean parent="SAML2.SSO" p:signAssertions="true" p:encryptAssertions="false"/>
                </list>
            </property>
        </bean>	

I have edited metadata-providers.xml to add the following:

<MetadataProvider id="ExampleCom" xsi:type="FilesystemMetadataProvider"
		metadataFile="%{idp.home}/metadata/example.xml">
	</MetadataProvider>	


I believe that I now need the proper URL to go to in order to initiate an SSO to this SP. This is where I am not clear on things. Based on the Sibboleth doc pages, I cobbled together the following URL (I am adding some spaces so that safelinks won't eat the URL) :

https:// shib3prodapp1 . ad.loyola.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=http%3a%2f%2fexample.example.com%2fexample%2flayoutscripts%2fCpal_SSO_AssertionConsumerService.aspx

I based this URL on the Shibboleth UnsolicitedSSO documentation and the URL that the vendor provided above. However, when I visit this URL, I get the "Web Login Service - Unsupported Request - The application you have accessed is not registered for use with this service" error.

Any thoughts? What am I missing or where am I screwing up?

Thanks again for your help!

-Tim Enders

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Nate Klingenstein
Sent: Tuesday, January 15, 2019 2:30 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Configuring Shibboleth v3 IdP for Unsolicited SSO (IdP Initiated SSO)

> If they want assertions signed rather than requests, you will need to modify relying-party.xml after all.  See signAssertions versus signRequests here:
> 
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FIDP30%2FSAML2SSOConfiguration&data=02%7C01%7Ctenders%40loyola.edu%7Cac05a6d06015403fe20108d67b1fd71c%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C1%7C636831774018186341&sdata=S5b4kdnj0%2B3EG3UhT%2BpajaQx3IyoKkYV1xvxWkfAbEk%3D&reserved=0

Pardon me, that should be responses and signResponses.

The garbled URL's in the email aren't relevant or part of the problem, though they would surely be in the metadata file itself.
-- 
For Consortium Member technical support, see https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7Cac05a6d06015403fe20108d67b1fd71c%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C1%7C636831774018186341&sdata=sat26NA8lJdo9s3LRz2dYymRBbCS1NDJTS8hrsdi94o%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net