<div dir="ltr">We ask that exact question a lot as it tends to get more "yes" answers out of vendors who may support SAML but for some odd reason have never heard of Shibboleth. As your an SP, I wouldn't read too deeply into the question. Tell them you're running the Shibboleth SP 2.5 and inquire about what type of IdP they're trying to bring to the table. After that, then worry about profiles and bindings.<div>
<br></div><div><div>Dave</div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, May 28, 2013 at 2:52 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 5/28/13 4:38 PM, "MikeWho" <<a href="mailto:who@me.com">who@me.com</a>> wrote:<br>
<br>
>During an integration discussion with a client, we were asked if our<br>
>application (i.e. site) is "SAML 2.0 compliant". Is there a specific<br>
>definition of/criteria for this? Do all 2.0 bindings need to be supported,<br>
>or just any one?<br>
<br>
</div>There is nothing in SAML conformance that addresses *deployments*, so this<br>
isn't a valid question, though it is a common one. What people usually<br>
mean is whether you have a deployment that uses an implementation of SAML<br>
that is itself generally conformant and won't be riddled with limitations.<br>
But you can use a conformant product and just pick all the worst options<br>
or impose the worst approaches, and it will be just as bad (not that you<br>
are, just making a point).<br>
<br>
The closest thing to a vanilla *deployment* profile that we have is<br>
saml2int (see <a href="http://saml2int.org" target="_blank">saml2int.org</a>). That is something a deployment can claim to<br>
support and addresses your other question, I think.<br>
<div class="im"><br>
>Instead of a yes/no answer, I guess I'll have to go with "well, we are<br>
>using<br>
>Shibboleth 2.5 SP to implement SP initiated SSO with HTTP Redirect<br>
>binding;<br>
>and support just-in-time user provisioning." But I don't know if that's a<br>
>yes, no or maybe.<br>
<br>
</div>That's pretty much a yes, but note that you described there the outgoing<br>
binding (SP to IdP) and not the inbound one.<br>
<br>
But it's often an implication, for example, that you're handling metadata<br>
"well", by virtue of using the only implementation in the world that does.<br>
In large respect, that fact alone is more important than most of the other<br>
SAML requirements you could try and enumerate, and it isn't captured<br>
anywhere in SAML 2.0's original, long outdated, conformance material.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>David Langenberg<div>Identity & Access Management</div><div>The University of Chicago</div>
</div>