<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:#0070C0;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0">Some non technical aspects added to this.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0">Encryption and signing are /should not be optional. IT is the right thing to do in all cases.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0">Vendors or campus developers should be “strongly encouraged” to the point of extreme exception . Support the encryption and signing you are trying to avoid.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0">We have a very few exceptions. But it is difficult for any SP in our base to be approved to not encrypt the assertion , etc.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0">This is not technical but rather standard, practice and risk based practice that we live by. I know many others who are essentially very similar. Vendors
will and have aligned when pushed on or other vendors exist. Institutionally developed applications are simply expected to accommodate the standard practice of requiring SP to encrypt /sign etc.. . <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0">Of 2000+ SPs running at our institution, we can count on my fingers SPs with exceptions and some of those are startup exceptions while adjustments/fixes are made
to the service provider to align with the institutional practice and standard of encryption… . <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0">-whc<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0">Warren Curry<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0">Identity Architect
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0">UF Information Technology – Indentity Services<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0">720 SW 2<sup>nd</sup> Street – Ayers Bldg<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0">352-273-1383<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#0070C0"><a href="http://identity.it.ufl.edu/"><span style="color:#0563C1">http://identity.it.ufl.edu/</span></a>
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0070C0"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Domingues, Michael D<br>
<b>Sent:</b> Thursday, January 24, 2019 11:53 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Encryption-less SP to auth against encryption-mandating IdP?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="divtagdefaultwrapper">
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Hi Daniel,<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">What portions of the proposed system are under your control? Are you responsible for the web application that wants to receive user data (the service provider), the system that authenticate
your users (the identity provider), or both?<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Fundamentally, Shibboleth isn't just one product --- it's a suite of products developed to fulfill the two (primary) roles in a SAML login flow. One piece of software, the Shibboleth
Service Provider (SP) works as an authentication middleware in conjunction with your web server, through something like mod_shib. mod_shib isn't the SP, it just bridges the SP software to your web application. The Shibboleth SP handles the generation of AuthN
requests, comes with metadata (that you'll need to customize), and parses the SAML assertions that get sent to it, exposing identity data to your web application via server variables (or headers).<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">The other primary piece of software Shibboleth Identity Provider. It handles responding to AuthN requests, authenticating your users, then resolving identity data from underlying
data connectors (LDAP, SQL, your person registry, etc) and sending SAML assertions to the SPs that sent the AuthN request in the first place.<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Typically, you're only concerned with one of these things --- you're an application developer (or server admin) looking to get the Service Provider installed, or an identity team,
looking to maintain the Identity Provider infrastructure for your institution.<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">If you control the SP, you absolutely can support encryption, metadata generation, etc. If you control the IdP, you can configure it on a per-SP basis (see the documentation for
relying-party.xml [1]) to change its requirements depending on what an SP supports. In this scenario, if you control the IdP but not the SP, you could configure the IdP to permit non-signed AuthN requests, and send unencrypted assertions to the SP in question.<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">I hope this helps,<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Michael<o:p></o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">[1]
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_IDP30_RelyingPartyConfiguration&d=DwMFAg&c=pZJPUDQ3SB9JplYbifm4nt2lEVG5pWx2KikqINpWlZM&r=UBkKx63rTinSBj-2DQ-E7g&m=RDSS14TKNDX7wgCXGQtKRRZINvo0NxkDusbs5Lb-3pY&s=PI2_MXR_TqSIVvQT7KT2Fq2Wsljd_-hcUKyNTnZMFSw&e=" id="LPlnk49102">
https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration</a><o:p></o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>>
on behalf of Daniel Smith <<a href="mailto:danielesmith@gmail.com">danielesmith@gmail.com</a>><br>
<b>Sent:</b> Thursday, January 24, 2019 10:40:42 AM<br>
<b>To:</b> <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Subject:</b> Encryption-less SP to auth against encryption-mandating IdP?</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">I'm new to Shibboleth as of today, and the documentation is a little overwhelming. I was wondering if the following scenario is possible:
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">1. SP requires SAML 2.0 assertion for user groups to assign roles, but does not support assertion decryption, nor metadata generation, nor authn request signing<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2. IdP mandates assertion encryption and authn request signing<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">3. Shibboleth hopefully sits in the middle, sending signed authn requests to IdP and decrypted SAML assertions to SP<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Ideally I'd like to use mod_shib as the SP already has Apache running. Is there a walkthrough for this kind of scenario or do I just have to keep reading? Or, is this kind of encryption-one-way-but-not-the-other not supported?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>