<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:11pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Just our two-cents to this whole mess. Qualtrics attempted to migrate our "brand" (their term for tenant) to one of their new SPs (<a href="https://ca1.qualtrics.com" class="OWAAutoLink" id="LPlnk207120" previewremoved="true">https://ca1.qualtrics.com</a>)
this morning. Despite having set their requested signing preferences (unsigned responses, signed assertions) in relying-party.xml, it seems that Qualtrics is still having issues consuming assertions their old SP was perfectly happy to accept.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Based on a comment they made earlier about missing an expected ePSA value, I suspect they might be trying to (erroneously) assume things about the order of multi-valued attributes. I'll update the list when we have more
information, but they've solidly bungled this. I'll also be pushing back to see if they'll change their signing preferences back to the default.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Michael<br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Karla Borecky <kborecky@smith.edu><br>
<b>Sent:</b> Friday, March 16, 2018 7:55:21 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Qualtrics integration changes</font>
<div> </div>
</div>
<div>
<div dir="ltr">I have a separate standalone metadata file for Qualtrics (for Smith, just like Lee's example) and I didn't have to add an exception to relying-party. That was a long while ago, though, so I don't know if something changed.</div>
<div class="x_gmail_extra"><br>
<div class="x_gmail_quote">On Fri, Mar 16, 2018 at 8:23 AM, Cantor, Scott <span dir="ltr">
<<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<span class="">> I suggested that Qualtrics should add WantAssertionsSigned="true" to their<br>
> metadata, but the InCommon metadata management form does not appear to<br>
> allow that.<br>
<br>
</span>It's something that usually demonstrates a non-compliant SAML SP, so I at least advised them that it was possibly going to incent bad behavior to start allowing it. That doesn't inherently mean it's a bad idea but it was something to consider.<br>
<span class=""><br>
> In case I am forced to add an override for Qualtrics to our relying-party.xml,<br>
> has anyone else done this already? I obviously need to sign assertions, but do I<br>
> need to explicitly not sign responses?<br>
<br>
</span>Once an SP is broken, there is no way to a priori know how broken it actually is. This presumes Qualtrics has no *actual* reason to be requiring them to be signed that is independent of the profile, such as an auditor saying something that they somehow
translated into "they have to be signed".<br>
<span class="x_HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span>
<div class="x_HOEnZb">
<div class="x_h5"><br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">
https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.<wbr>net</a><br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="x_gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div style="margin-left:40px">Karla Borecky<br>
Systems Administrator<br>
ITS<br>
Smith College<br>
Northampton, MA 01063<br>
</div>
<div style="margin-left:40px"><br>
</div>
<div style="margin-left:40px"><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>