<div dir="ltr"><div><div><div>Thanks Marco :) Very helpful.<br><br></div>In the default IdP Metadata generated, there are 3 KeyDescriptor elements - 2 x signing, and 1 x encryption.<br><br></div>Only 1 is needed? <br><br></div>Thanks.<br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 23, 2016 at 12:16 AM, Marco Malavolti <span dir="ltr"><<a href="mailto:marco.malavolti@garr.it" target="_blank">marco.malavolti@garr.it</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p>I will try to suggest you the changes, but if someone sees
mistakes, please, gives his correction:</p>
<pre>vim /opt/shibboleth-idp/metadata.xml
======================================================================================================================
<IDPSSODescriptor> SECTION:
– From the list of "protocolSupportEnumeration" remove:
- urn:oasis:names:tc:SAML:1.1:protocol
- urn:mace:shibboleth:1.0
– Remove the endpoint:
<ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location=<a href="https://idp.example.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution" target="_blank">"https://idp.example.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution"</a> index="1"/>
(and modify the index value of the next one to “1”)
– Remove the endpoint:
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
– Replace the endpoint:
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
with:
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
(because my IdP uses persistent SAML NameIDs)
- Remove the endpoint:
<SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location=<a href="https://idp.example.org/idp/profile/Shibboleth/SSO" target="_blank">"https://idp.example.org/idp/profile/Shibboleth/SSO"</a>/>
- Remove all ":8443" from the existing URL (such port is not used anymore)
<AttributeAuthorityDescriptor> Section:
– From the list "protocolSupportEnumeration" replace the value of:
- urn:oasis:names:tc:SAML:1.1:protocol
with
- urn:oasis:names:tc:SAML:2.0:protocol
- Remove the comment from:
<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location=<a href="https://idp.mi.garr.it/idp/profile/SAML2/SOAP/AttributeQuery" target="_blank">"https://idp.mi.garr.it/idp/profile/SAML2/SOAP/AttributeQuery"</a>/>
- Remove the endpoint:
<AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location=<a href="https://idp.example.org:8443/idp/profile/SAML1/SOAP/AttributeQuery" target="_blank">"https://idp.example.org:8443/idp/profile/SAML1/SOAP/AttributeQuery"</a>/>
- Remove all ":8443" from the existing URL (such port is not used anymore)
</pre>
<pre>======================================================================================================================</pre>
Best Regards,<br>
Marco<div><div class="h5"><br>
<br>
<br>
<div>Il 22/06/2016 22.43, Joel Levin ha
scritto:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>We are deploying an IdP for our organization -- all looks
good so far.<br>
<br>
</div>
<div>But I am not 100% sure I understand what to use for the
metadata.<br>
<br>
</div>
<div>We won't support SAML1 or 8443.<br>
<br>
</div>
<div>So far, we have use the default generated when installed.<br>
<br>
</div>
<div>Is there any guide on editing the metadata for what we
need? With something this security focused, I rather not
guess......<br>
<br>
</div>
<div><br>
<br>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</blockquote>
<br>
</div></div><span class="HOEnZb"><font color="#888888"><pre cols="72">--
Marco Malavolti
Consortium GARR - Servizio IDEM GARR AAI
Via dei Tizii, 6 - I-00185 (ROMA)
CF: 37284570583 - PI:07577141000
Skype: marco.mala</pre>
</font></span></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div>