Portable system for testing SAML 2 systems

Thu May 20 23:07:52 UTC 2021

Thanks Brent. You make a good point, which would have been obvious to me if I had looked back at the Basic Interaction diagram on the Shibboleth home page<https://wiki.shibboleth.net/confluence/display/CONCEPT>.

Arthur

From: users <users-bounces at shibboleth.net> on behalf of Brent Putman <putmanb at georgetown.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, May 20, 2021 at 4:04 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Portable system for testing SAML 2 systems

USE CAUTION: External Message.

Therefore, I’m looking at SAML debugging tools which I can use to isolate problems that may arise, like SAMLTEST.ID<https://urldefense.proofpoint.com/v2/url?u=https-3A__samltest.id_&d=DwMDaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=OzquOH3k-k5OvUBMOIvnes7lI16wMtPnCxWcZ__HJM0&s=3Wd9eTS7zasVDPNprQHiyntipcaXiqfPPqb4OJx9m4I&e=>. However, I cannot use SAMLTEST.ID<https://urldefense.proofpoint.com/v2/url?u=https-3A__samltest.id_&d=DwMDaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=OzquOH3k-k5OvUBMOIvnes7lI16wMtPnCxWcZ__HJM0&s=3Wd9eTS7zasVDPNprQHiyntipcaXiqfPPqb4OJx9m4I&e=> itself, as my site is in our Intranet, and only accessible to clients on site or connected via a VPN.

Unless you are doing back-channel (and you almost certainly are not), the SP does not need to be reachable by the IdP directly, nor vice versa.  They don't communicate directly, messages are passed front-channel via the user's browser.  As long as the user sitting at the browser can reach both, then that's fine.  In other words, as long as a user sitting on your intranet or VPN can reach both your internal SP and SAMLTEST.ID<https://urldefense.proofpoint.com/v2/url?u=http-3A__SAMLTEST.ID&d=DwQDaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=OzquOH3k-k5OvUBMOIvnes7lI16wMtPnCxWcZ__HJM0&s=dkxK1Q2G4rTVxMLooa8fdpONEn9_OV77Lw3Obemn69Q&e=> on the internet, that works.  However, if your intranet or VPN restricts traffic outbound to the internet from the users' computers, then yeah, that would be a problem.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210520/e799dbff/attachment.htm>