<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1529504827229_3514"><span id="yui_3_16_0_ym19_1_1529504827229_3513">Hi Peter,</span></div><div id="yui_3_16_0_ym19_1_1529504827229_3519"><span><br></span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1529504827229_3521"><span id="yui_3_16_0_ym19_1_1529504827229_3520"> Sorry if I confused you. When I asked for docs or websites I meant to increase my knowledge of Shibboleth. A Shibboleth for dummies that assumes I know nothing but can take me through all the config files and explain what each does and why and how the components work. I do refer to the docs on shibboleth.net but I find them very dry and have to drill down several layers as definitions rely on other definitions. <br></span></div><div dir="ltr"><span><br></span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1529504827229_3527"><span id="yui_3_16_0_ym19_1_1529504827229_3526"> I understand SAML at the 50,000 foot level in how the SP redirects to the IDP, authenticates against the IDP, builds a token and returns it to the SP, but when I get into issues like this where there is more involved than just exchanging metadata and configuring an attribute filter I find myself crawling down rat holes.</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1529504827229_3693"><span id="yui_3_16_0_ym19_1_1529504827229_3526"><br></span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1529504827229_3725"><span id="yui_3_16_0_ym19_1_1529504827229_3526"> The forum is very helpful but I'd like to be able to come at it with a better understanding so I can be sure I'm asking the right questions.</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1529504827229_3726"><span id="yui_3_16_0_ym19_1_1529504827229_3526"><br></span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1529504827229_3727"><span id="yui_3_16_0_ym19_1_1529504827229_3526">Thanks</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1529504827229_3728"><span id="yui_3_16_0_ym19_1_1529504827229_3526">-Bob</span></div><div id="yui_3_16_0_ym19_1_1529504827229_3729"> </div><div class="signature" id="yui_3_16_0_ym19_1_1529504827229_3731"><div id="yui_3_16_0_ym19_1_1529504827229_3730">--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Wednesday, June 20, 2018 5:48 AM, Peter Schober <peter.schober@univie.ac.at> wrote:<br></font></div> <br><br> <div class="y_msg_container">* Thermal Reboot <<a shape="rect" ymailto="mailto:thermalreboot@gmail.com" href="mailto:thermalreboot@gmail.com">thermalreboot@gmail.com</a>> [2018-06-19 20:13]:<br clear="none">> Yes, it is simplesamlphp.org, it's part of a Drupal setup.<br clear="none">> <br clear="none">> What can I advise them? I've read that simplesaml.php supports SAML2<br clear="none">> and I'd thought that was the default.<br clear="none"><br clear="none">By default SimpleSAMLphp will add both SAML1 and SAML2 endpoints from<br clear="none">imported SAML 2.0 Metadata, both when using the metarefresh[1] module<br clear="none">as well as using SSP's admin web UI (where you paste SAML 2.0 metadata<br clear="none">into a form and get back SSP's internal representation for use in its<br clear="none">config files).<br clear="none"><br clear="none">Newer versions of metarefresh can also filter on SAML version, so you<br clear="none">could only import the SAML2 bits. Not knowing anything about the SP<br clear="none">there's not much to say here, it may not be using that way of<br clear="none">automatic importing, or it may not have configured protocol filtering,<br clear="none">or it may be using out-of-date software, or any one of other reasons.<br clear="none"><br clear="none">If the SP hand-crafted the internal metadata (which simply consists of<br clear="none">nested PHP arrays) all bets are off, of course.<br clear="none"><br clear="none">> Can you recommend any websites or docs I might use to increase my<br clear="none">> understanding of these concepts?<br clear="none"><br clear="none">There's not much to it and essentially everything I'd say here would<br clear="none">be off-topic on the Shibboleth list. The relevant docs[2] just mention<br clear="none">use of the admin UI or to hand-craft it. I've already mentioned<br clear="none">metarefresh, which has its own section in the docs and is not mention<br clear="none">here.<br clear="none"><br clear="none">I guess it all boils down to how exactly they import or curate<br clear="none">metadata describing your IDP for/within SimpleSAMLphp.<br clear="none"><br clear="none">If the software is picking SAML1 as the protocol it cannot possibly be<br clear="none">configured properly unless your own IDP's metadata only included SAML1<br clear="none">(which I cannot know and you don't say).<br clear="none"><br clear="none">-peter<br clear="none"><br clear="none">[1] <a shape="rect" href="https://simplesamlphp.org/docs/stable/simplesamlphp-automated_metadata" target="_blank">https://simplesamlphp.org/docs/stable/simplesamlphp-automated_metadata</a><br clear="none">[2] <a shape="rect" href="https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_2" target="_blank">https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_2</a><div class="yqt6806714220" id="yqtfd72454"><br clear="none">-- <br clear="none">For Consortium Member technical support, see <a shape="rect" href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>