<html><head></head><body><div>Hi Everyone,</div><div><br></div><div>I've been looking at adding new SPs to our existing IDP, but also transitioning away from SAML 1 in favor of SAML 2 as best we can. To this end, I'm suspecting I could give new SPs a copy of our metadata that has SAML1 elements removed in order to achieve a transition.</div><div><br></div><div>Here's what we have currently:</div><div><br></div><blockquote type="cite"><div> <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="<a href="https://itfederation.jmu.edu:8443/idp/profile/SAML1/SOAP/ArtifactResolution">https://itfederation.jmu.edu:8443/idp/profile/SAML1/SOAP/ArtifactResolution</a>" index="1"/></div><div><br></div><div> <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/ArtifactResolution">https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/ArtifactResolution</a>" index="2"/></div><div> </div><div> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SLO">https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SLO</a>" /></div><div> </div><div> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/POST/SLO">https://itfederation.jmu.edu/idp/profile/SAML2/POST/SLO</a>" /></div><div> </div><div> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/SLO">https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/SLO</a>" /></div><div> </div><div> <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat></div><div> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat></div><div><br></div><div> <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="<a href="https://itfederation.jmu.edu/shibboleth-idp/SSO" >"="">https://itfederation.jmu.edu/shibboleth-idp/SSO"/></a>;</div><div> </div><div> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/POST/SSO" >"="">https://itfederation.jmu.edu/idp/profile/SAML2/POST/SSO"/></a>;</div><div><br></div><div> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/POST-SimpleSign/SSO" >"="">https://itfederation.jmu.edu/idp/profile/SAML2/POST-SimpleSign/SSO"/></a>;</div><div> </div><div> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SSO" >"="">https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SSO"/></a>;</div></blockquote><div><br></div><div><br></div><div>And here's what I'm thinking we could do:</div><div><br></div><blockquote type="cite"><div> <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/ArtifactResolution">https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/ArtifactResolution</a>" index="2"/></div><div> </div><div> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SLO">https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SLO</a>" /></div><div> </div><div> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/POST/SLO">https://itfederation.jmu.edu/idp/profile/SAML2/POST/SLO</a>" /></div><div> </div><div> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/SLO">https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/SLO</a>" /></div><div> </div><div> </div><div> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat> </div></blockquote><blockquote type="cite"><div> </div><div> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/POST/SSO" >"="">https://itfederation.jmu.edu/idp/profile/SAML2/POST/SSO"/></a>;</div><div><br></div><div> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/POST-SimpleSign/SSO" >"="">https://itfederation.jmu.edu/idp/profile/SAML2/POST-SimpleSign/SSO"/></a>;</div><div> </div><div> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SSO" >"="">https://itfederation.jmu.edu/idp/profile/SAML2/Redirect/SSO"/></a>;</div></blockquote><div><br></div><div>Then change:</div><blockquote type="cite"><div><AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol"></div></blockquote><div><br></div><div><br></div><div>to something like:</div><blockquote type="cite"><div><AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div></blockquote><div><br></div><div><br></div><div>And lastly change from this:</div><blockquote type="cite"><div><AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="<a href="https://itfederation.jmu.edu:8443/shibboleth-idp/AA" >"="">https://itfederation.jmu.edu:8443/shibboleth-idp/AA"/></a>;</div><div> </div><div> <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery" >"="">https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery"/></a>;</div><div> </div><div> <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat></div><div> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat></div></blockquote><div><br></div><div>To:</div><blockquote type="cite"><div><br></div><div> </div><div> <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery" >"=""><a href="https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>">https://itfederation.jmu.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery"/></a></a>; </div></blockquote><blockquote type="cite"><div> <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat></div></blockquote><div><br></div><div><br></div><div>Am I on the right track with this? What I'd want to do is supply the modified metadata to new SPs so that we have one less thing to worry about transitioning, and supply it to InCommon so that we could, in theory at least, have a fairly seamless transition since the IDP still technically supports SAML1, but would only be advertising SAML2 in metadata.</div><div><br></div><div>Thanks for any tips I can get on this.</div><div><br></div><div>Regards,</div><div><br></div><div><br></div><div class="-x-evo-signature-wrapper"><span><pre>--
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235</pre></span></div></body></html>