<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 2/5/16 6:50 PM, Brent Putman wrote:<br>
</div>
<blockquote cite="mid:56B5353D.6040705@georgetown.edu" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
For example the binding it's sending is bogus, since it's not
going to do that anyway, as would be the AWS SP metadata.<br>
</blockquote>
<br>
<br>
To answer one of the technical questions raised: Their metadata is
here [1] and only includes 1 ACS, with the SAML 2 POST binding:<br>
<br>
<tt><AssertionConsumerService index="1" isDefault="true"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location=<a class="moz-txt-link-rfc2396E" href="https://signin.aws.amazon.com/saml">"https://signin.aws.amazon.com/saml"</a>/></tt><br>
<br>
<br>
They also support standard SAML 2 Web SSO profile for the admin
console UI, etc, so this is I believe used for that also. So as far
as the guy's script goes, he's naively doing what AWS wants him to
do to make it work, bogus as it is.<br>
<br>
Interestingly they also have in there an AttributeConsumingService,
with a whole slew of RequestedAttributes from the eduPerson spec.
Oh boy. <br>
<br>
<br>
[1] <a class="moz-txt-link-freetext" href="https://signin.aws.amazon.com/static/saml-metadata.xml">https://signin.aws.amazon.com/static/saml-metadata.xml</a>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
</body>
</html>