<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I should have asked an explicit question: how should a Login handler be configured in a Sessions element?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Arthur<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b><span style="color:black">From: </span>
</b><span style="color:black">users <users-bounces@shibboleth.net> on behalf of "Goldberg, Arthur P" <arthur.p.goldberg@mssm.edu><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Thursday, May 20, 2021 at 7:25 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Configure Login handler<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Hello Shib users</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black">Earlier I wrote that I’m configuring an SP using Shibboleth and Apache that will access an IdP that uses Azure. </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">I believe that all the parts of the SP and IdP that I understand are now configured. One remaining part the confuses me is the configuration of the Login Handler in the SP. The Azure
people specify a login URL of the form,</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=">https://login.microsoftonline.com/</a>
uid-here /saml2</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">which is the same as a logout URL. My shibboleth2.xml file contains this Sessions element, with the same uid-here in multiple places:</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <Sessions lifetime="28800" timeout="3600" checkAddress="false"</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> relayState="ss:mem" handlerSSL="true" cookieProps="https"></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!-- AG: entityID configured; is the trailing "/" right? does it matter? --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!--
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=">
https://wiki.shibboleth.net/confluence/display/SP3/SSO</a> --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <SSO isDefault="true" entityID="<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__sts.windows.net_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=DLyMNq7lc0wzI-08UJwgDa0zWD6a7VOErJbcop-m7fo&e=">https://sts.windows.net/</a>
uid-here /"></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> SAML2 SAML1</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </SSO></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!-- AG: configured --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <Logout outgoingBindings="<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=">https://login.microsoftonline.com/</a>
uid-here /saml2">SAML2</Logout></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!-- AG: confused --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!--
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=">
https://wiki.shibboleth.net/confluence/display/SP3/SSO</a> refers to a ''"/Login" handler'</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> but
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_Handler&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=kCKiDGBq8gCbOb_Q7ImF2TTLfpF4_K92LF0lmqX-Xe0&e=">
https://wiki.shibboleth.net/confluence/display/SP3/Handler</a> does not. How should the</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> login URL of an Azure SAML2 IdP be configured? --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!-- Extension service that generates "approximate" metadata based on SP configuration. --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!-- Status reporting service. --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <Handler type="Status" Location="/Status" acl="<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__127.0.0.1&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=V733VTQkzIjkYewWfcUAXfTlOTVauVAWUvBMOuJV7Zw&e=">127.0.0.1</a>
::1"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!-- Session diagnostic service. --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <Handler type="Session" Location="/Session" showAttributeValues="true"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <!-- JSON feed of discovery information. --></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> <Handler type="DiscoveryFeed" Location="/DiscoFeed" dir="/data/shibds/discofeed"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </Sessions></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">See my comments about the Login Handler. In addition, I tried configuring a <Login> element structured like the Logout element, but shibd failed to start. Also, a search for “Login
handler” in the Service Provider 3 space on <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__wiki.shibboleth.net&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=Ewed1y_zfgdvPRV_pwpRFOxdLy3YTyrS8U0jfBtU5ug&e=">
wiki.shibboleth.net</a> did not return documentation that enlightened me WRT configuring the Login Handler.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Thanks</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt">Arthur</span><o:p></o:p></p>
</div>
</body>
</html>