Removing SAML1 and backchannel support from our IdP

[Max Spicer]

>
> Yes, because if you don't and an SP requests that protocol binding, your
> IdP will respond on the assumption the SP will be able to make its callback
> and your metadata will prevent that.

Thanks, that helps a lot but I worry I may still have a misconfiguration /
misunderstanding.

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631690/SAML2ArtifactResolutionConfiguration
recommends to disable the SAML2.ArtifactResolution profile configuration
bean if not in use. On this basis, I was planning to remove that bean from
our relying party config and now know that I should also set
idp.artifact.enabled = false. I've already removed
the ArtifactResolutionService endpoint from our metadata, which may have
been premature. With all these changes in place, do I need to do anything
else to disable/prevent use of the Artifact profile with Browser SSO?

Regards,

Max

On Tue, 26 Sept 2023 at 17:24, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > As we don't advertise support for the ArtifactResolutionService does that
> > mean we should also set idp.artifact.enabled = false?
>
> Yes, because if you don't and an SP requests that protocol binding, your
> IdP will respond on the assumption the SP will be able to make its callback
> and your metadata will prevent that.
>
> I was simply saying that tearing down an extra port/connector has nothing
> to do with whether you support SOAP-based profiles. Nobody needs an extra
> port anymore, regardless.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230927/ad125b97/attachment.htm>