IDP 4.3 and non URL SP entity IDs

[Wessel, Keith]

Well, now, that's a neat trick, Microsoft.

Scott, I'm failing to understand the risk of setting ignoreScoping to true if there is one. If I understand the docs correctly, the ignoreScoping attribute tells the IdP whether to pass through the SP's <saml2:Scoping> elements or to drop the elements from the incoming request and generate its own. Is that correct? And what are the ramifications of passing them through vs. having the IdP generate its own, other than the obvious issue with Microsoft that Roberto reported?

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via users
Sent: Thursday, January 19, 2023 8:42 AM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: IDP 4.3 and non URL SP entity IDs

> that wasn't there before and Microsoft's IDP doesn't like the fact 
> that box.net is not in URL format:

That is certainly rich, considering they don't even enforce that for the actual entityID to begin with (AFAIK). Beyond belief, but I guess half correct is better than not at all.

> What is adding that Scoping section? 

Automatic, it's part of the spec and was a bug (that it wasn't populated).

Maybe people should start taking us seriously when we say to stop accepting SPs with improper entityIDs.

You can suppress the entire Scoping element by adding ignoreScoping as a profile configuration setting.

https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631694/SAML2SSOConfiguration__;!!DZ3fjg!6A2sdp2fncDW3giquM8F1fm6ShKaXFOREcq4TPT8qWUZAldsAtormNDE1Nar54sk40jRqGiFXSs5fficBdXr$ 

-- Scott


--
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!6A2sdp2fncDW3giquM8F1fm6ShKaXFOREcq4TPT8qWUZAldsAtormNDE1Nar54sk40jRqGiFXSs5fUWrMdZt$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net