<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">Thanks Scott. I saw back channel SAML2 attribureQuery to port 8443 from other SP in the access log. Since SAML1 attributeQuery uses the same port, I think secure channel negotiation works.
If SP sent it, I should see it in Apache access log. Right?</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div apple-content-edited="true" class="">
<div class="">
<div style="orphans: 2; widows: 2;" class="">Hong </div>
</div>
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 13, 2016, at 1:58 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">On 3/13/16, 1:40 PM, "users on behalf of Hong Ye" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:hy93@cornell.edu" class="">hy93@cornell.edu</a>> wrote:<br class="">
<br class="">
<br class="">
<br class="">
<blockquote type="cite" class="">With IDP2, it return<br class="">
<saml1:AuthenticationStatement AuthenticationInstant="2016-03-13T14:29:52.202Z"<br class="">
AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"<br class="">
<blockquote type="cite" class="">With IDP3, it return<br class="">
</blockquote>
</blockquote>
<br class="">
That was a bug, the old IdP didn't prevent the misuse of SAML 2 contexts as SAML 1 methods.<br class="">
<br class="">
<blockquote type="cite" class=""> After IDP3 sent back SAML assertion, SP didn’t send backchannel query at all( I didn’t see it from access log).<br class="">
</blockquote>
<br class="">
That doesn't mean it didn't try and fail. Failure to negotiate a secure channel can't possibly show up in an application log behind the web server.<br class="">
<br class="">
<blockquote type="cite" class="">I guess maybe this SP only accept PasswordProtectedTransport authenticationMethod?
<br class="">
</blockquote>
<br class="">
I doubt it.<br class="">
<br class="">
<blockquote type="cite" class="">When RemoteUser is used, is "urn:oasis:names:tc:SAML:1.0:am:unspecified” the correct authenticationMethod to send back?<br class="">
</blockquote>
<br class="">
You are responsible for configuring the values you want it to use. The values defined in SAML 1 are limited and you can find them in the original standard.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
-- <br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
</body>
</html>