<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Le 16/10/2013 11:50, Peter Schober a
écrit :<br>
</div>
<blockquote cite="mid:20131016095004.GS9610@aco.net" type="cite">
<pre wrap="">* Jehan Procaccia <a class="moz-txt-link-rfc2396E" href="mailto:Jehan.Procaccia@it-sudparis.eu"><Jehan.Procaccia@it-sudparis.eu></a> [2013-10-16 11:15]:
</pre>
<blockquote type="cite">
<pre wrap="">org.opensaml.ws.message.decoder.MessageDecodingException: SAML 2
SPSSODescriptor could not be resolved from metadata for SP entityID:
<a class="moz-txt-link-freetext" href="https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp">https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp</a>
</pre>
</blockquote>
<pre wrap="">
What does the metadata for that SP look like?
(You do have metadata for that SP on record, right?)</pre>
</blockquote>
As they don't run a shibboleth SP (nor a simplesamlphp or whatever
else ..) they didn't provide me any metadata :-( <br>
So I "figured out" some myself for them !<br>
I took some as a template from a traditional 2.5 shib SP and changed
entidyID , SSL certificate (taken from their https site), and URL in
bindings reflecting their site name <br>
you can have a look a it at<br>
<a class="moz-txt-link-freetext" href="http://shibidp1.int-evry.fr/metadata/fed-sp-ext.xml">http://shibidp1.int-evry.fr/metadata/fed-sp-ext.xml</a><br>
it is the first
entityID=<a class="moz-txt-link-rfc2396E" href="https://test.travel.com/travelsite/externalauthenticateimt.jsp">"https://test.travel.com/travelsite/externalauthenticateimt.jsp"</a><br>
I must admit that it is challenging to figure out metadata for
someone else SP , and I might have guess wrong .<br>
<br>
But their "IDP initiaded" solution does work with their other
clients ...so I would like to make it work with a shibboleth IDP .<br>
<br>
here's their workflow specifications (which I deducted to be a
IDP-initiaded workflow)<br>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Cambria","serif";mso-fareast-language:FR"
lang="EN-US">1 .The user authenticates to the Identity Provider.</span><span
style="font-size:10.0pt;font-family:"Cambria","serif";mso-fareast-language:FR"
lang="EN-GB"><br>
2. The user requests access to the site Travel Enterprise by
clicking on a link on the intranet</span><span
style="font-size:12.0pt" lang="EN-GB"> </span><span
style="font-size:10.0pt;font-family:"Cambria","serif";mso-fareast-language:FR"
lang="EN-GB"> <br>
3 . The Identity provider builds the SAML authentication message
incorporating the unique identifier shared by Travel and
the Identity Provider of the customer</span><span
style="font-size:10.0pt;font-family:"Cambria","serif";mso-fareast-language:FR"
lang="EN-US"><br>
4 . Travel servers identify the user<br>
5 . The user accesses its Travel environment.</span><span
style="font-size:12.0pt" lang="EN-US"> </span></p>
They told me that they are expecting a SAML reponse as that:<br>
<br>
<p class="MsoNormal"><span style="color:#1F497D"><samlp:Response
xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
MajorVersion="1" MinorVersion="1"
ResponseID="a75adf55-01d7-40cc-929f-dbd8372ebdfc" <span
style="background:yellow;mso-highlight:yellow">Recipient="<b><a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://test.traveldoo.com/TraveldooSite2/ExternalAuthenticateIMT.jsp">https://test.travel.com/TravelSite2/ExternalAuthenticateIMT.jsp</a></b>"</span>
IssueInstant="2013-10-09T08:55:00Z"><o:p></o:p></span><span
style="color:#1F497D"><br>
</span><span style="color:#1F497D" lang="EN-US"><samlp:Status><o:p></o:p></span><span
style="color:#1F497D" lang="EN-US"><br>
<samlp:StatusCode Value="samlp:Success"/><o:p></o:p></span><span
style="color:#1F497D" lang="EN-US"><br>
</samlp:Status><o:p></o:p></span><span
style="color:#1F497D" lang="EN-US"><br>
<saml:Assertion
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
MajorVersion="1" MinorVersion="1"<br>
...<br>
</span></p>
If their SP receives that kind of response, then our user should
access their site.<br>
If that workflow is compatible with shibboleth, then how can I
create correct Metadata to feed my IDP with to make it work !?<br>
<br>
<blockquote cite="mid:20131016095004.GS9610@aco.net" type="cite">
<pre wrap="">
If so does it claim SAML2 support e.g. in the
SPSSODescriptor/@protocolSupportEnumeration and
AssertionConsumerService/@Binding attributes?</pre>
</blockquote>
No, according to their SAML reponse massage sample, it supports only
SAML 1.1<br>
<blockquote cite="mid:20131016095004.GS9610@aco.net" type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">then is there a SAML 1.x IDP Unsolicited/SSO config sample ?
</pre>
</blockquote>
<pre wrap="">
I would guess having correct metadata for that SP alone would suffice.</pre>
</blockquote>
yes, again, how to create them if they don't provide me metadata for
their SP ?<br>
<br>
Thanks.<br>
</body>
</html>