Configuring Shibboleth v3 IdP for Unsolicited SSO (IdP Initiated SSO)

[Timothy Enders]

Sorry, safelinks garbled that URL. I will try and correct it below. I am going to have to add spaces to the URL so it won't get eaten.

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Timothy Enders
Sent: Tuesday, January 15, 2019 2:19 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Configuring Shibboleth v3 IdP for Unsolicited SSO (IdP Initiated SSO)

Also it is probably worth noting that the metadata they provided me was formatted in a very different way than all of the other ones I've ever seen, which I assumed was because this was IdP Initiated, but now I am questioning that. Here's a copy:

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
                     validUntil="2018-05-13T20:34:25Z"
                     cacheDuration="PT604800S"
                     entityID="VendorName">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                     Location=" https:// companalyst. salary. Com /companalyst/layoutscripts/Cpal_SSO_AssertionConsumerService.aspx"
                                     index="1" />
        
    </md:SPSSODescriptor>
</md:EntityDescriptor>


And that's the entire thing. I've already provided them our metadata, so *theoretically* their end is set up to receive my login attempts, but so far I'm not even getting to that point because my Shib IdP isn't processing the requests properly.

I suspect that either:
1. I am malformatting the URL I am trying to use, or 2. I have missed something with loading their metadata so Shib sees them as a valid endpoint.


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Timothy Enders
Sent: Tuesday, January 15, 2019 2:13 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Configuring Shibboleth v3 IdP for Unsolicited SSO (IdP Initiated SSO)

Nate, thank you for the response.

So, where do I load the metadata? I have a copy of it in %idphome%\metadata in a file named "vendorname.xml"

So I assume that now I have to also add an entry in metadata-providers.xml for the vendor as a FileSystemMetadataProvider and then re-start the service to reload the metadata?

-Tim

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Nate Klingenstein
Sent: Tuesday, January 15, 2019 2:04 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Configuring Shibboleth v3 IdP for Unsolicited SSO (IdP Initiated SSO)

Timothy,

> I am new to the list, and relatively new to Shibboleth, so forgive me if I am about to ask something obvious here.

Nothing's obvious until you know about it, right?

> I have the metadata from the vendors SP, but I have no idea what I 
> need to do on my IdP in order to get it to work properly. Whenever I try variations on the URL format given in that wiki article, I get back an error from Shibboleth that  states Web Login Service  Unsupported Request. The application you have accesses is not registered for use with this service.

If the metadata works for SP-initiated login, then it should work for IdP-initiated login, but I don't know if you've gotten that style of integration working with this particular vendor.

> I assume that I have to add a Metadata provider, add this guy to the relying-party.xml and set up the attribute filter for it, but it doesnt seem to work like a standard SP initiated SSO does.

My guess is that either you haven't loaded the metadata yet or the entityID that you're using to invoke the unsolicited login is simply different from the one in the metadata.  You can see the entityID in the main EntityDescriptor element of the metadata.

You shouldn't need to change the relying-party.xml file unless they have some special requirements.

Take care,
Nate.
--
For Consortium Member technical support, see https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7Ce895c0dc3276411938ce08d67b1e458c%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C636831767283103904&sdata=S9MnS9%2FADHgwiAckC11ruyoLS8bs2sw7%2BEkkM6Xyru4%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
For Consortium Member technical support, see https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7Ctenders%40loyola.edu%7Ce895c0dc3276411938ce08d67b1e458c%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C636831767283103904&sdata=S9MnS9%2FADHgwiAckC11ruyoLS8bs2sw7%2BEkkM6Xyru4%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net