How to configure IdP with zero info from SP ?

[Nate Klingenstein]

Mohamed,

Your guesses were right, but they're signing their authentication requests
(above and beyond in all the wrong ways).  Your IdP will be unable to
verify the signature -- or use the AuthnRequest -- unless you have the
correct signing certificate included in the SP metadata that you wrote.

It's almost always possible to configure your IdP to work with these SPs.
It's just... challenging.

Hope this helps,
Nate



On Fri, Mar 3, 2023 at 11:22 AM Mohamed Lrhazi via users <
users at shibboleth.net> wrote:

> Hello,
>
> I am trying to add a new SP to our IdP... the SP is very uncooperative :(
> they provide no metadata, no entityid... etc. Their UI just has to fields
> for me to fill:
>
> Entry point is the URL of your school's SAML server endpoint that will
> perform Single Sign On authentication. Acadeum will redirect your students
> to this URL when performing Single Sign On login. After your SAML server
> has authenticated the student, it will redirect back to Acadeum with the
> student's info such as their email address.
>
> Certificate *
> The certificate of your school's SAML server that will be used to validate
> the authenticity and integrity of SAML messages received from your school's
> SAML server. The certificate is generated from your school's SAML server
> private key that is used to sign outgoing SAML messages
>
>
> so I tried entering our IdP signing certificate and for entry point I
> tried :
>
> https://idp.cua.edu/idp/profile/SAML2/Redirect/SSO
>
> This causes their UI to redirect my browser to perform a SAML login... and
> our IdP errors out : A non-proceed event occurred while processing the
> request: MessageAuthenticationError
>
> I created and added a metadata file for this SP, using the entity ID I see
> them using in their SAML request attempts....
>
> Their GET request contains some extra params, in addition to the
> SAMLRequest:
>
>
>    1. RelayState:
>
>    {"institutionId":000,"redirectTo":"/settings/authentication","redirectToWebsite":"courseshare","singleSignOnSetupToken":"00965f0....d06af2"}
>    2. SigAlg:
>    http://www.w3.org/2000/09/xmldsig#rsa-sha1
>    3. Signature:
>    AYeGoLLzUEVyShLw....
>
>
> Is it possible to configure our IdP to work with such SP ?
>
> Thanks,
> Mohamed.
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230303/1ddb9ee3/attachment.htm>