IDP Metadata Binding order

[Brent Putman]

On 10/22/23 3:31 PM, José Ramalho wrote:
>
> For my surprise, the validation failed because my SingleSignOnService 
> Bindings are declared before the SingleLogoutService Binding.
>
> In terms of SAML is this order relevant?
>
>

In terms of XML schema validity, yes the order in this particular case 
is relevant.  I don't personally know whether samltest.id is performing 
full schema validation per se, but sounds like they are at least 
checking the schema-defined order.

You can consult the saml-schema-metadata-2.0.xsd from the SAML 2.0 spec 
if you want it straight from the source, but a quick summary is that in 
an IDPSSODescriptor the order of child elements has to be like below. 
Order of child elements doesn't always matter in schema - depends on 
how it's written - but in this metadata case the elements are all in an 
ordered <sequence>.

<!-- From SSODescriptorType -->
<element ref="md:ArtifactResolutionService" minOccurs="0" 
maxOccurs="unbounded"/>
<element ref="md:SingleLogoutService" minOccurs="0" maxOccurs="unbounded"/>
<element ref="md:ManageNameIDService" minOccurs="0" maxOccurs="unbounded"/>
<element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>

<!-- From IDPSSODescriptorType -->
<element ref="md:SingleSignOnService" maxOccurs="unbounded"/>
<element ref="md:NameIDMappingService" minOccurs="0" 
maxOccurs="unbounded"/>
<element ref="md:AssertionIDRequestService" minOccurs="0" 
maxOccurs="unbounded"/>
<element ref="md:AttributeProfile" minOccurs="0" maxOccurs="unbounded"/>
<element ref="saml:Attribute" minOccurs="0" maxOccurs="unbounded"/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231022/1a2927ba/attachment.htm>