<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Chance,<div><br></div><div>The verbiage in the email makes me a little suspect about the level of familiarity the vendor has with SAML, particularly if they consider receiving and processing an XML message as not operating and maintaining an SP.</div><div><br></div><div>That said, what they basically want is IdP-initiated SSO with an assertion that contains the username as an attribute. Shibboleth makes this easy as of 2.3.x.</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO</a></div><div><br></div><div>The SHIRE is the "url we would specify". The providerId is their entityID. The target is the destination page.</div><div><br></div><div>If they can make use of something like eduPersonPrincipalName or uid as a way to get the username, that's great. Otherwise you'll have to define a custom attribute for them, and we would ask that you do so in a namespace you control. If it comes to that and you need help, let us know.</div><div><br></div><div>Hope this helps,</div><div>Nate.</div><div><br></div><div><br><div><div>On Aug 1, 2011, at 19:52 , Chance Cox wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; ">This is a snippet from an email I received this week. This vendor does not want to maintain an SP, however they do have a SAML system setup. Can anyone help me understand if this is possible, and how i would go about doing it?</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; ">Thanks in advance for any help.</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; ">----------------------------------------------------------------</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; ">The way that the SAML framework operates. When you authenticate a user on your portal, you can provide a link or button there to send send an xml file to a url we would specify. That xml file will be in the SAML framework – encrypted and would contain the institution ID – Elon – and the user’s username. That is sufficient for us to authenticate the user.</div><p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; "> </p><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; ">Shibboleth uses SAML and should be able to generate the required xml file. For more on SAML, see:</div><p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; "> </p><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; color: rgb(45, 44, 250); "><span style="text-decoration: underline; "><a href="http://en.wikipedia.org/wiki/Security_Assertion_Markup_Language">http://en.wikipedia.org/wiki/Security_Assertion_Markup_Language</a></span></div><p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; "> </p><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 15px/normal Calibri; ">As we don’t have any working knowledge of the implementation of the Shibboleth system, I think you will have to work out on your own how to actually make this happen. When you are in a position to generate the xml file, let us know and we will provide a URL for you to point to. We can then begin testing. We won’t create the url (or rather the processing page behind it) until you are able to generate the xml file as we will need that to know how to interpret and parse it.</div></blockquote></div><br></div></body></html>