<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">Hello Everyone,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks to all who provided answers. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Our SOAP binding issue got sorted finally. The IDP hadn't specified the correct port number and had left it on port 443. When they flipped that to port 9443, it all magically worked
<span style="font-family:Wingdings">J</span><o:p></o:p></p>
<p class="MsoPlainText">It also means that you do not necessarily need a KeyDescriptor with a signing certificate for attributeQuery requests when you are using another port than 443 (e.g. 9443) and a simple certificate exchange to be able to perform the Attribute
Query query request over a TLS (SSL) is working fine.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none">
<tbody>
<tr>
<td width="623" valign="top" style="width:467.5pt;border:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoPlainText">(…)<o:p></o:p></p>
<p class="MsoPlainText"><md:AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></p>
<p class="MsoPlainText"> <md:AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://idp.domain:9443/idp/attrsvc.ssaml2">https://idp.domain:9443/idp/attrsvc.ssaml2</a>"/>
<md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat><o:p></o:p></p>
<p class="MsoPlainText"> <span lang="DE"><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="DE"> </span></md:AttributeAuthorityDescriptor><o:p></o:p></p>
<p class="MsoPlainText">(…)<o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I hope this can help others.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Cheers,<o:p></o:p></p>
<p class="MsoPlainText">Christian.<o:p></o:p></p>
<p class="MsoPlainText">________________________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Christian Pruvost
<o:p></o:p></p>
<p class="MsoPlainText">Technical Product Manager – Elsevier <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span lang="EN-US">-----Original Message-----<br>
From: users [mailto:users-bounces@shibboleth.net] On Behalf Of Peter Schober<br>
Sent: 27 November 2017 13:19<br>
To: users@shibboleth.net<br>
Subject: Re: Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) :::</span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">*** External email: use caution ***<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span lang="PT-BR">* Tom Scavo <</span><a href="mailto:trscavo@gmail.com"><span lang="PT-BR" style="color:windowtext;text-decoration:none">trscavo@gmail.com</span></a><span lang="PT-BR">> [2017-11-27 13:56]:<o:p></o:p></span></p>
<p class="MsoPlainText">> > There's nothing stopping that now<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Well then I guess I didn't understand what you meant by "we're going
<o:p></o:p></p>
<p class="MsoPlainText">> to turn off the auto-querying functionality in 3.0?" If the SP emits a
<o:p></o:p></p>
<p class="MsoPlainText">> query, it needs a signing certificate in metadata, full stop.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">You can comment out the SP's Handler/@type="AttributeQuery" today.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-peter<o:p></o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
<span style="color:windowtext;text-decoration:none">https://wiki.shibboleth.net/confluence/x/coFAAg</span></a><o:p></o:p></p>
<p class="MsoPlainText">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
<span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
</div>
<style>P {margin:0cm:margin-bottomL.0001pt;}</style><br>
<hr>
<p><span style="font-size:10pt;font-family:"Arial","sans-serif"">Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.</span>
<br clear="none">
</p>
</body>
</html>