<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hello Shib users<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Earlier I wrote that I’m configuring an SP using Shibboleth and Apache that will access an IdP that uses Azure. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I believe that all the parts of the SP and IdP that I understand are now configured. One remaining part the confuses me is the configuration of the Login Handler in the SP. The Azure people specify a login
URL of the form,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">https://login.microsoftonline.com/ uid-here /saml2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">which is the same as a logout URL. My shibboleth2.xml file contains this Sessions element, with the same uid-here in multiple places:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Sessions lifetime="28800" timeout="3600" checkAddress="false"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> relayState="ss:mem" handlerSSL="true" cookieProps="https"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- AG: entityID configured; is the trailing "/" right? does it matter? --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- https://wiki.shibboleth.net/confluence/display/SP3/SSO --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <SSO isDefault="true" entityID="https://sts.windows.net/ uid-here /"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> SAML2 SAML1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </SSO><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- AG: configured --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Logout outgoingBindings="https://login.microsoftonline.com/ uid-here /saml2">SAML2</Logout><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- AG: confused --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- https://wiki.shibboleth.net/confluence/display/SP3/SSO refers to a ''"/Login" handler'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> but https://wiki.shibboleth.net/confluence/display/SP3/Handler does not. How should the<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> login URL of an Azure SAML2 IdP be configured? --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- Extension service that generates "approximate" metadata based on SP configuration. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- Status reporting service. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- Session diagnostic service. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Handler type="Session" Location="/Session" showAttributeValues="true"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <!-- JSON feed of discovery information. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Handler type="DiscoveryFeed" Location="/DiscoFeed" dir="/data/shibds/discofeed"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </Sessions><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">See my comments about the Login Handler. In addition, I tried configuring a <Login> element structured like the Logout element, but shibd failed to start. Also, a search for “Login handler” in the Service
Provider 3 space on wiki.shibboleth.net did not return documentation that enlightened me WRT configuring the Login Handler.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Arthur<o:p></o:p></span></p>
</div>
</body>
</html>