Configuring Shibboleth v3 IdP for Unsolicited SSO (IdP Initiated SSO)

[Nate Klingenstein]

Tim,

> Also it is probably worth noting that the metadata they provided me was formatted in a very different way than all of the other ones I've ever seen, which I assumed was because this was IdP Initiated, but now I am questioning that. Here's a copy:

> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"

It seems to have expired about 7 months ago.  That will be a problem.  You'll need to ask them to update that or fix it yourself.

>     <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

If they want assertions signed rather than requests, you will need to modify relying-party.xml after all.  See signAssertions versus signRequests here:

https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration

Note that assertions sent to this SP won't be encrypted because they don't provide a public key.  You'll need to either get them to add one, add that to the relying party definition as well(see example and search for encryption optional):

https://wiki.shibboleth.net/confluence/display/IDP30/Workday

or globally make encryption optional in idp.xml using the boolean property.

Take care,
Nate.