<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>I will try to suggest you the changes, but if someone sees
mistakes, please, gives his correction:</p>
<pre>vim /opt/shibboleth-idp/metadata.xml
======================================================================================================================
<IDPSSODescriptor> SECTION:
– From the list of "protocolSupportEnumeration" remove:
- urn:oasis:names:tc:SAML:1.1:protocol
- urn:mace:shibboleth:1.0
– Remove the endpoint:
<ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location=<a class="moz-txt-link-rfc2396E" href="https://idp.example.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution">"https://idp.example.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution"</a> index="1"/>
(and modify the index value of the next one to “1”)
– Remove the endpoint:
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
– Replace the endpoint:
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
with:
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
(because my IdP uses persistent SAML NameIDs)
- Remove the endpoint:
<SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location=<a class="moz-txt-link-rfc2396E" href="https://idp.example.org/idp/profile/Shibboleth/SSO">"https://idp.example.org/idp/profile/Shibboleth/SSO"</a>/>
- Remove all ":8443" from the existing URL (such port is not used anymore)
<AttributeAuthorityDescriptor> Section:
– From the list "protocolSupportEnumeration" replace the value of:
- urn:oasis:names:tc:SAML:1.1:protocol
with
- urn:oasis:names:tc:SAML:2.0:protocol
- Remove the comment from:
<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location=<a class="moz-txt-link-rfc2396E" href="https://idp.mi.garr.it/idp/profile/SAML2/SOAP/AttributeQuery">"https://idp.mi.garr.it/idp/profile/SAML2/SOAP/AttributeQuery"</a>/>
- Remove the endpoint:
<AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location=<a class="moz-txt-link-rfc2396E" href="https://idp.example.org:8443/idp/profile/SAML1/SOAP/AttributeQuery">"https://idp.example.org:8443/idp/profile/SAML1/SOAP/AttributeQuery"</a>/>
- Remove all ":8443" from the existing URL (such port is not used anymore)
</pre>
<pre>======================================================================================================================</pre>
Best Regards,<br>
Marco<br>
<br>
<br>
<div class="moz-cite-prefix">Il 22/06/2016 22.43, Joel Levin ha
scritto:<br>
</div>
<blockquote
cite="mid:CAGfxv+9SOqi85TJ_8VUs+n2aKTs+x0EOQQyEAPWD5VcYRM6+1A@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>We are deploying an IdP for our organization -- all looks
good so far.<br>
<br>
</div>
<div>But I am not 100% sure I understand what to use for the
metadata.<br>
<br>
</div>
<div>We won't support SAML1 or 8443.<br>
<br>
</div>
<div>So far, we have use the default generated when installed.<br>
<br>
</div>
<div>Is there any guide on editing the metadata for what we
need? With something this security focused, I rather not
guess......<br>
<br>
</div>
<div><br>
<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Marco Malavolti
Consortium GARR - Servizio IDEM GARR AAI
Via dei Tizii, 6 - I-00185 (ROMA)
CF: 37284570583 - PI:07577141000
Skype: marco.mala</pre>
</body>
</html>