Removing SAML1 and backchannel support from our IdP

[Max Spicer]

Hi Scott,

We only advertise support for SingleSignonService bindings in our metadata.
As we don't advertise support for the ArtifactResolutionService does that
mean we should also set idp.artifact.enabled = false?

I suspect I am missing some key understanding here.

Thanks,

Max

On Mon, 25 Sept 2023 at 14:24, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Set the idp.artifact.enabled property to false? I'm not sure about this
> one - it
> > seems to default to true on new IdP installs but they do not include
> > backchannel support
>
> SOAP support (which is required by the artifact binding) and the
> "backchannel" are orthgonal. The latter term in this context tends to refer
> to having an alternate port for the traffic, not simply whether it's
> supported or not.
>
> The primary thing is "nobody should be using the alternate port anymore"
> whether they need SOAP support or not. It runs over 443 now.
>
> Secondarily, if you want to disallow the SOAP traffic, you can turn "most"
> of it off with the changes suggested, but you do still have logout, which
> can happen over SOAP, though very rarely. But that's down to what's in your
> metadata of course.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230926/b4097aa9/attachment.htm>