<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div apple-content-edited="true" class="">There wasn’t any error in the IDP log. The only difference between IDP 3 response and IDP 2 response was the authenticationMethod in the SAML assertion. IDP use remote user authentication which hasn’t been changed.
With IDP2, it return </div>
<div apple-content-edited="true" class="">
<pre id="txt" style="line-height: 16px;" class=""><saml1:AuthenticationStatement AuthenticationInstant="2016-03-13T14:29:52.202Z"
AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
></pre>
<div class="">With IDP3, it return</div>
</div>
<div apple-content-edited="true" class=""><br class="">
</div>
<div class="">
<pre id="txt" style="line-height: 16px;" class=""> <saml1:AuthenticationStatement AuthenticationInstant="2016-03-13T14:10:23.350Z"
AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified"
</pre>
<div class="">After IDP3 sent back SAML assertion, SP didn’t send backchannel query at all( I didn’t see it from access log). I guess maybe this SP only accept <span style="line-height: 16px;" class="">PasswordProtectedTransport authenticationMethod? </span></div>
<div class=""><span style="line-height: 16px;" class=""><br class="">
</span></div>
<div class=""><span style="line-height: 16px;" class="">When RemoteUser is used, is "urn:oasis:names:tc:SAML:1.0:am:unspecified” the correct authenticationMethod to send back?</span></div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
</div>
<div class="">Hong</div>
<div class=""><br class="">
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 13, 2016, at 12:45 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">On 3/13/16, 11:57 AM, "users on behalf of Tom Scavo" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:trscavo@gmail.com" class="">trscavo@gmail.com</a>> wrote:<br class="">
<br class="">
<br class="">
<blockquote type="cite" class=""><br class="">
You have a single signing certificate in metadata that serves two<br class="">
functions, that is, a SAML message signing certificate and a<br class="">
back-channel TLS certificate. I believe IdP V3 is configured for<br class="">
separate, distinct certificates out-of-the-box,<br class="">
</blockquote>
<br class="">
If you ignore the documentation and don't upgrade, yes.<br class="">
<br class="">
<blockquote type="cite" class="">so you need to figure<br class="">
out how to configure V3 to use the same certificate for both purposes<br class="">
(to match your metadata).<br class="">
</blockquote>
<br class="">
The IdP is not a web server, it's the web server that has a certificate configured for a second port. Even if the IdP generated one, it's the deployer that makes the decision which one to use.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
<blockquote type="cite" class=""><br class="">
</blockquote>
-- <br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</body>
</html>