<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Is this not what Dedra is doing?</div>
<div><br>
</div>
<div><a href="http://www.cirrusidentity.com/gateway/">http://www.cirrusidentity.com/gateway/</a></div>
<div><br>
</div>
<div><u>-Bryan</u></div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>IAM David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, November 2, 2016 at 5:26 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>[Ext] Re: WORKPLACE BY FACEBOOK integration<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">I was provided:
<div>
<p class="gmail-p1">Audience URL <a href="https://www.facebook.com/company/1077798945674112">https://www.facebook.com/company/1077798945674112</a></p>
<p class="gmail-p1">Recipient URL <a href="https://alaska.facebook.com/work/saml.php">https://alaska.facebook.com/work/saml.php</a></p>
<p class="gmail-p1">ACS (Assertion Consumer Service) URL <a href="https://alaska.facebook.com/work/saml.php">https://alaska.facebook.com/work/saml.php</a></p>
<p class="gmail-p1">I'm guessing Recipient is entityID</p>
<p class="gmail-p1">db</p>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Nov 2, 2016 at 3:22 PM, Cantor, Scott <span dir="ltr">
<<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class="">> WORKPLACE BY FACEBOOK apparently deploys simpleSAML PHP / SAML 2.0<br>
> for SSO but provides minimal documentation. No metadata or certificate, no<br>
> attribute requirements, etc.<br>
<br>
</span>The bare minimum is the endpoint, if the implementation is broken and doesn't check Audience conditions. That's not per se a security hole unless they also don't check the Recipient attribute, but that takes some dedicated pen-testing to determine. I
have done integrations that did not have an entityID and worked like that, though after reporting it I was able to get them to configure one (in their view, the audience to check for).<br>
<br>
When in doubt, stick whatever the user identifier has to be in the NameID and see if it works, assuming you know the endpoint to create the metadata around.<br>
<br>
It is less work to just experiment, which takes a few minutes, than worry about getting all the details right.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</body>
</html>