<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:11pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Hi Daniel,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">What portions of the proposed system are under your control? Are you responsible for the web application that wants to receive user data (the service provider), the system that authenticate your users (the identity provider),
or both?</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Fundamentally, Shibboleth isn't just one product --- it's a suite of products developed to fulfill the two (primary) roles in a SAML login flow. One piece of software, the Shibboleth Service Provider (SP) works as an
authentication middleware in conjunction with your web server, through something like mod_shib. mod_shib isn't the SP, it just bridges the SP software to your web application. The Shibboleth SP handles the generation of AuthN requests, comes with metadata
(that you'll need to customize), and parses the SAML assertions that get sent to it, exposing identity data to your web application via server variables (or headers).</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">The other primary piece of software Shibboleth Identity Provider. It handles responding to AuthN requests, authenticating your users, then resolving identity data from underlying data connectors (LDAP, SQL, your person
registry, etc) and sending SAML assertions to the SPs that sent the AuthN request in the first place.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Typically, you're only concerned with one of these things --- you're an application developer (or server admin) looking to get the Service Provider installed, or an identity team, looking to maintain the Identity Provider
infrastructure for your institution.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">If you control the SP, you absolutely can support encryption, metadata generation, etc. If you control the IdP, you can configure it on a per-SP basis (see the documentation for relying-party.xml [1]) to change its requirements
depending on what an SP supports. In this scenario, if you control the IdP but not the SP, you could configure the IdP to permit non-signed AuthN requests, and send unencrypted assertions to the SP in question.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">I hope this helps,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Michael</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">[1] <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration" class="OWAAutoLink" id="LPlnk49102" previewremoved="true">
https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration</a><br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Daniel Smith <danielesmith@gmail.com><br>
<b>Sent:</b> Thursday, January 24, 2019 10:40:42 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Encryption-less SP to auth against encryption-mandating IdP?</font>
<div> </div>
</div>
<div>
<div dir="auto">I'm new to Shibboleth as of today, and the documentation is a little overwhelming. I was wondering if the following scenario is possible:
<div dir="auto"><br>
</div>
<div dir="auto">1. SP requires SAML 2.0 assertion for user groups to assign roles, but does not support assertion decryption, nor metadata generation, nor authn request signing</div>
<div dir="auto">2. IdP mandates assertion encryption and authn request signing</div>
<div dir="auto">3. Shibboleth hopefully sits in the middle, sending signed authn requests to IdP and decrypted SAML assertions to SP</div>
<div dir="auto"><br>
</div>
<div dir="auto">Ideally I'd like to use mod_shib as the SP already has Apache running. Is there a walkthrough for this kind of scenario or do I just have to keep reading? Or, is this kind of encryption-one-way-but-not-the-other not supported?</div>
<div dir="auto"><br>
</div>
<div dir="auto">Thanks,</div>
</div>
</div>
</body>
</html>