Configure Login handler

[Goldberg, Arthur P]

Hello Shib users

Earlier I wrote that I’m configuring an SP using Shibboleth and Apache that will access an IdP that uses Azure.

I believe that all the parts of the SP and IdP that I understand are now configured. One remaining part the confuses me is the configuration of the Login Handler in the SP. The Azure people specify a login URL of the form,

https://login.microsoftonline.com/ uid-here /saml2

which is the same as a logout URL. My shibboleth2.xml file contains this Sessions element, with the same uid-here in multiple places:

        <Sessions lifetime="28800" timeout="3600" checkAddress="false"
                relayState="ss:mem" handlerSSL="true" cookieProps="https">

            <!-- AG: entityID configured; is the trailing "/" right? does it matter? -->
            <!-- https://wiki.shibboleth.net/confluence/display/SP3/SSO -->
            <SSO isDefault="true" entityID="https://sts.windows.net/ uid-here /">
                SAML2 SAML1
            </SSO>

            <!-- AG: configured -->
            <Logout outgoingBindings="https://login.microsoftonline.com/ uid-here /saml2">SAML2</Logout>

            <!-- AG: confused -->
            <!-- https://wiki.shibboleth.net/confluence/display/SP3/SSO refers to a ''"/Login" handler'
            but https://wiki.shibboleth.net/confluence/display/SP3/Handler does not. How should the
            login URL of an Azure SAML2 IdP be configured? -->

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed" dir="/data/shibds/discofeed"/>
        </Sessions>

See my comments about the Login Handler. In addition, I tried configuring a <Login> element structured like the Logout element, but shibd failed to start. Also, a search for “Login handler” in the Service Provider 3 space on wiki.shibboleth.net did not return documentation that enlightened me WRT configuring the Login Handler.

Thanks
Arthur
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210520/cedfcd86/attachment.htm>