<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 11/18/15 5:12 PM, Wessel, Keith
wrote:<br>
</div>
<blockquote
cite="mid:A1EB7EC659FA0F429A55865D5820006D2E3BAE10@CITESMBX1.ad.uillinois.edu"
type="cite">
<pre wrap="">
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
includeAttributeStatement="true" assertionLifetime="PT5M" assertionProxyCount="0" signResponses="never" signAssertions="always" encryptAssertions="never" encryptNameIds="never" includeConditionsNotBefore="true" maximumSPSessionLifetime="PT1H" />
</rp:RelyingParty>
Based on what I think I've found the defaults for SAML2SSO, I've added the following override block to my V3 relying-party.xml:
<bean parent="RelyingPartyByName" c:relyingPartyIds="urn:amazon:webservices">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signResponses="false" p:signAssertions="true" />
</list>
</property>
</bean>
</pre>
</blockquote>
<br>
Off-hand I'm not seeing any obvious problems with that<br>
<br>
<blockquote
cite="mid:A1EB7EC659FA0F429A55865D5820006D2E3BAE10@CITESMBX1.ad.uillinois.edu"
type="cite">
<pre wrap="">
Am I missing something? Or is the relying party configuration not the issue? Anyone have advice for other pieces of the IDP configuration where I might have gone astray?
</pre>
</blockquote>
<br>
<br>
I've never setup AWS, so I can't offer specific IdP config
suggestions but: If you have a v2 IdP working with AWS, then you
might just capture (via Firefox SAML Tracer, etc) the working v2
Response and the non-working v3 Response, and compare them. Find
the significant deltas and work back from there to the necessary
config changes.<br>
</body>
</html>