<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Le 16/10/2013 16:34, Peter Schober a
écrit :<br>
</div>
<blockquote cite="mid:20131016143443.GF9610@aco.net" type="cite">
<pre wrap="">* Peter Schober <a class="moz-txt-link-rfc2396E" href="mailto:peter.schober@univie.ac.at"><peter.schober@univie.ac.at></a> [2013-10-16 12:59]:
</pre>
<blockquote type="cite">
<pre wrap="">So that it basically looks more something like this:
<a class="moz-txt-link-freetext" href="http://pastebin.com/TVbZjrSu">http://pastebin.com/TVbZjrSu</a>
</pre>
</blockquote>
<pre wrap="">
So, from all we've gathered so far, you'll need to to this:
Add the above metadata to your IdP (local metadata file, request
addition to your federation, whatever), as per
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPCommunicate">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPCommunicate</a>
(You'll still need to fix any AssertionConsumerService lines in that
metadata, since they contain made-up values.)</pre>
</blockquote>
OK I added the metadata in my IDP relying-party.xml as you provided
in <a class="moz-txt-link-freetext" href="http://pastebin.com/TVbZjrSu">http://pastebin.com/TVbZjrSu</a>, leaving the ACS lines as you fix
them, as I don't have other better clue .<br>
<br>
<MetadataProvider id="ShibbolethMetadata"
xsi:type="ChainingMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"><br>
<!-- fed-sp-ext test travel --><br>
<MetadataProvider id="fedeIMText"
xsi:type="FileBackedHTTPMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata" <br>
metadataURL="<a class="moz-txt-link-freetext"
href="http://shibidp1.int-evry.fr/metadata/fed-sp-ext.xml">http://shibidp1.int-evry.fr/metadata/fed-sp-ext.xml</a>"<br>
backingFile="/opt/shibboleth-idp/metadata/<a
class="moz-txt-link-freetext"
href="http://shibidp1.int-evry.fr/metadata/fed-sp-ext.xml">fed-sp-ext.xml</a>"><br>
</MetadataProvider><br>
<br>
<blockquote cite="mid:20131016143443.GF9610@aco.net" type="cite">
<pre wrap="">
Then set includeAttributeStatement="true" either for the
DefaultRelyingParty (ProfileConfiguration
xsi:type="saml:ShibbolethSSOProfile"), as per
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPShibSSOProfileConfig">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPShibSSOProfileConfig</a>
Or (if you don't want to send unencrypted attributes to all your SAML1
SPs) create a custom RelyingParty configuration in your
relying-party.xml just for this SP and set it there only:
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty</a></pre>
</blockquote>
default includeAttributeStatement was already fixed to true in my
relaying-party.xml file :<br>
<br>
<DefaultRelyingParty
provider=<a class="moz-txt-link-rfc2396E" href="https://idp.int-evry.fr/idp/shibboleth">"https://idp.int-evry.fr/idp/shibboleth"</a><br>
defaultSigningCredentialRef="IdPCredential"><br>
<ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" <br>
<b> includeAttributeStatement="true"</b><br>
assertionLifetime="300000"<br>
signResponses="conditional"<br>
signAssertions="never" /><br>
<br>
...<br>
<ProfileConfiguration xsi:type="saml:SAML2SSOProfile" <br>
<b> includeAttributeStatement="true"</b><br>
assertionProxyCount="0" <br>
signResponses="conditional"<br>
signAssertions="always" <br>
encryptAssertions="conditional"<br>
encryptNameIds="conditional" /><br>
<br>
<blockquote cite="mid:20131016143443.GF9610@aco.net" type="cite">
<pre wrap="">
After all that you should be able to initiate a session with this SP
using the request protocol Scott pointed you to, something like:
<a class="moz-txt-link-freetext" href="https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp">https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp</a></pre>
</blockquote>
Yes, calling that URL from my browser <br>
<a class="moz-txt-link-freetext" href="https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp">https://idp.int-evry.fr/idp/profile/Shibboleth/SSO?target=https%3A%2F%2Ftest.travel.com%2F&providerId=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp&shire=https%3A%2F%2Ftest.travel.com%2FTravelSite2%2FExternalAuthenticateIMT.jsp</a><br>
does return me to our IDP SSO login page and finally ends at their
SP ;-) <br>
<br>
My IDP logs while accessing the above URL are :<br>
<br>
17:25:38.676 - INFO [Shibboleth-Access:73] -
20131016T152538Z|157.159.21.185|idp.int-evry.fr:443|/profile/Shibboleth/SSO|<br>
17:25:54.320 - INFO [Shibboleth-Access:73] -
20131016T152554Z|157.159.21.185|idp.int-evry.fr:443|/profile/Shibboleth/SSO|<br>
17:25:54.402 - INFO [Shibboleth-Audit:745] -
20131016T152554Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||<a class="moz-txt-link-freetext" href="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp">https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp</a>|urn:mace:shibboleth:2.0:profiles:saml1:sso|<a class="moz-txt-link-freetext" href="https://idp.int-evry.fr/idp/shibboleth">https://idp.int-evry.fr/idp/shibboleth</a>|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_5ec2804f8603ecfee1041bbc4c931b17|procacci|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|supannEtablissement,transientId,email,|_9a020512fbe201ef30d82a24da0dea2c|_338263ad9f732730c9ccca08d4372a14,|<br>
<br>
looks good so far .<br>
<br>
then on their site it fails to login, but it might be because I
didn't sent them a correct value of attribute for login name<br>
They told me that they created an account for me with the ID of my
email address, I must figure out now a way to send my email as the
username for that SP ...<br>
I will check my IDP attribute-resolver.xml and attribute-filter.xml
to fix that ,<br>
do you confirm that it is the correct next step ?<br>
<br>
Thanks a lot .<br>
<blockquote cite="mid:20131016143443.GF9610@aco.net" type="cite">
</blockquote>
<br>
</body>
</html>