<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello,<br>
<br>
One of our new Service Provider tels us that he is SAML 1.0 SSO
compatible, but isn't implementing a shibboleth SP.<br>
It's SSO workflow is IDP initiaded, which if I understood well , in
the shibboleth terminology means <a moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO">IdPUnsolicitedSSO</a>
:<br>
<a moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO</a><br>
So I configured my shibboleth IDP (2.4.0) according to the above
specification with the example of SAML 2.0 provided as there's no
sample config for SAML 1.x and I can't figure out one (a sample
config would be greatly appreciated !)<br>
Unfortunatly , using that configuration, when from a browser I
directly request the IDP for that unsolicited SSO:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://shibidp1.it-sudparis.eu/idp/profile/SAML2/Unsolicited/SSO">https://idp.int-evry.fr/idp/profile/SAML2/Unsolicited/SSO</a>?<b>providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp</b><br>
<br>
it fails :<br>
<br>
10:17:11.155 - INFO [Shibboleth-Access:73] -
20131016T081711Z|157.159.21.185|idp.int-evry.fr:443|/profile/SAML2/Unsolicited/SSO|<br>
10:17:11.157 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400]
- Error decoding authentication request message<br>
org.opensaml.ws.message.decoder.MessageDecodingException: SAML 2
SPSSODescriptor could not be resolved from metadata for SP entityID:
<a class="moz-txt-link-freetext"
href="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp">https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp</a><br>
at
edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSODecoder.lookupACSURL(UnsolicitedSSODecoder.java:256)
~[shibboleth-identityprovider-2.4.0.jar:na]<br>
at
edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSODecoder.doDecode(UnsolicitedSSODecoder.java:170)
~[shibboleth-identityprovider-2.4.0.jar:na]<br>
at
org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79)
~[openws-1.5.0.jar:na]<br>
...<br>
<br>
I suspect that it is because I declared SAML 2.0 config <a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://shibidp1.it-sudparis.eu/idp/profile/SAML2/Unsolicited/SSO">Unsolicited/SSO</a>
but talk to a SAML 1.0 SP ...<br>
<br>
Is shibboleth 2.4.0 IDP able to work this way (IDP initiaded) with a
SAML 1.0 SP ? <br>
then is there a SAML 1.x IDP <a moz-do-not-send="true"
class="moz-txt-link-freetext"
href="https://shibidp1.it-sudparis.eu/idp/profile/SAML2/Unsolicited/SSO">Unsolicited/SSO</a>
config sample ?<br>
Do I have to add metadata for that SP in my federation ?<br>
<br>
thanks for you help .<br>
<br>
<br>
</body>
</html>