<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m having some trouble configuring my Shibboleth SP for use with IdP initiated SSO. This is the IdP’s metadata:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="bpjyTajR3wad3ssQLvH9t51OE8_" cacheDuration="PT1440M" entityID="pfd.digitalinsight.com"><o:p></o:p></p>
<p class="MsoNormal"><md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="false"><o:p></o:p></p>
<p class="MsoNormal"><md:KeyDescriptor use="signing"><o:p></o:p></p>
<p class="MsoNormal"><ds:KeyInfo xmlns:ds=<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>><o:p></o:p></p>
<p class="MsoNormal"><ds:X509Data><o:p></o:p></p>
<p class="MsoNormal"><ds:X509Certificate> …snip… </ds:X509Certificate><o:p></o:p></p>
<p class="MsoNormal"></ds:X509Data><o:p></o:p></p>
<p class="MsoNormal"></ds:KeyInfo><o:p></o:p></p>
<p class="MsoNormal"></md:KeyDescriptor><o:p></o:p></p>
<p class="MsoNormal"><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1: </md:NameIDFormat><o:p></o:p></p>
<p class="MsoNormal"><saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="XML_DATA" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/><o:p></o:p></p>
<p class="MsoNormal"><saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="USER_ID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/><o:p></o:p></p>
<p class="MsoNormal"><saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="FI_ID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/><o:p></o:p></p>
<p class="MsoNormal"><saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="KEEP_ALIVE_URL" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"></md:IDPSSODescriptor><o:p></o:p></p>
<p class="MsoNormal"><md:ContactPerson contactType="administrative">…snip…<o:p></o:p></p>
<p class="MsoNormal"></md:ContactPerson><o:p></o:p></p>
<p class="MsoNormal"></md:EntityDescriptor><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">You can see it has no SingleSignOnService node so it fails validation. I’ve added a dummy node and loaded the metadata locally, but Shibboleth tries to use that dummy node to log on, rather than the incoming session from the IdP. I also
believe I should be using encryption, which their metadata makes no mention of…so I’m not sure it’s correct at all. Below is an example SAML request from the IdP:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><samlp:Response Destination="...snip..."<o:p></o:p></p>
<p class="MsoNormal"> ID="pwNA20Jgy1UJs63nFHh4Q_GWUeP" IssueInstant="2021-10-28T16:08:56.907Z" Version="2.0"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></p>
<p class="MsoNormal"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">pfd.digitalinsight.com</saml:Issuer><o:p></o:p></p>
<p class="MsoNormal"> <ds:Signature xmlns:ds=<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>><o:p></o:p></p>
<p class="MsoNormal"> <ds:SignedInfo><o:p></o:p></p>
<p class="MsoNormal"> <ds:CanonicalizationMethod Algorithm=<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>/><o:p></o:p></p>
<p class="MsoNormal"> <ds:SignatureMethod Algorithm=<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>/><o:p></o:p></p>
<p class="MsoNormal"> <ds:Reference URI="#pwNA20Jgy1UJs63nFHh4Q_GWUeP"><o:p></o:p></p>
<p class="MsoNormal"> <ds:Transforms><o:p></o:p></p>
<p class="MsoNormal"> <ds:Transform Algorithm=<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>/><o:p></o:p></p>
<p class="MsoNormal"> <ds:Transform Algorithm=<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>/><o:p></o:p></p>
<p class="MsoNormal"> </ds:Transforms><o:p></o:p></p>
<p class="MsoNormal"> <ds:DigestMethod Algorithm=<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>/><o:p></o:p></p>
<p class="MsoNormal"> <ds:DigestValue>...snip...</ds:DigestValue><o:p></o:p></p>
<p class="MsoNormal"> </ds:Reference><o:p></o:p></p>
<p class="MsoNormal"> </ds:SignedInfo><o:p></o:p></p>
<p class="MsoNormal"> <ds:SignatureValue><o:p></o:p></p>
<p class="MsoNormal"> ...snip...<o:p></o:p></p>
<p class="MsoNormal"> </ds:SignatureValue><o:p></o:p></p>
<p class="MsoNormal"> <ds:KeyInfo><o:p></o:p></p>
<p class="MsoNormal"> <ds:X509Data><o:p></o:p></p>
<p class="MsoNormal"> <ds:X509Certificate><o:p></o:p></p>
<p class="MsoNormal"> ...snip...<o:p></o:p></p>
<p class="MsoNormal"> </ds:X509Certificate><o:p></o:p></p>
<p class="MsoNormal"> </ds:X509Data><o:p></o:p></p>
<p class="MsoNormal"> </ds:KeyInfo><o:p></o:p></p>
<p class="MsoNormal"> </ds:Signature><o:p></o:p></p>
<p class="MsoNormal"> <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><o:p></o:p></p>
<p class="MsoNormal"> <saml:EncryptedAssertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><o:p></o:p></p>
<p class="MsoNormal"> <xenc:EncryptedData Type=<a href="http://www.w3.org/2001/04/xmlenc#Element">http://www.w3.org/2001/04/xmlenc#Element</a><o:p></o:p></p>
<p class="MsoNormal"> xmlns:xenc=<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>><xenc:EncryptionMethod Algorithm=<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>/><o:p></o:p></p>
<p class="MsoNormal"> <ds:KeyInfo xmlns:ds=<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>><o:p></o:p></p>
<p class="MsoNormal"> <xenc:EncryptedKey><xenc:EncryptionMethod Algorithm=<a href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</a>/><o:p></o:p></p>
<p class="MsoNormal"> <xenc:CipherData><o:p></o:p></p>
<p class="MsoNormal"> <xenc:CipherValue>...snip...</xenc:CipherValue><o:p></o:p></p>
<p class="MsoNormal"> </xenc:CipherData><o:p></o:p></p>
<p class="MsoNormal"> </xenc:EncryptedKey><o:p></o:p></p>
<p class="MsoNormal"> </ds:KeyInfo><o:p></o:p></p>
<p class="MsoNormal"> <xenc:CipherData><o:p></o:p></p>
<p class="MsoNormal"> <xenc:CipherValue>...snip...</xenc:CipherValue><o:p></o:p></p>
<p class="MsoNormal"> </xenc:CipherData><o:p></o:p></p>
<p class="MsoNormal"> </xenc:EncryptedData><o:p></o:p></p>
<p class="MsoNormal"> </saml:EncryptedAssertion><o:p></o:p></p>
<p class="MsoNormal"></samlp:Response><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve configured Shibboleth with the correct signing and encryption certificates and I don’t receive any errors anywhere that I can see. But rather than logon attempts in the transaction.log this is all I get:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2021-10-28 17:42:19|Shibboleth-TRANSACTION.AuthnRequest|||pfd.digitalinsight.com||||||urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST||||||<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any ideas what my configuration should look like for this IdP? Or is the problem with their metadata?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div dir="ltr" style="mso-line-height-rule:exactly;-webkit-text-size-adjust:100%;direction:ltr;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;"><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;line-height:normal;"><tr style="font-size:0;"><td align="left" style="padding:0 10px 0 0;vertical-align:top;"><img src="cid:image968291.png@4C039EF2.FE563830" height="64" border="0" alt="" style="height:64px;min-height:64px;max-height:64px;font-size:0;" /></td><td align="left" style="padding:10px 0 10px 10px;vertical-align:middle;"><table cellpadding="0" cellspacing="0" border="0" style="width:100%;font-size:0;"><tr style="font-size:24px;color:#0033A0;font-style:normal;font-weight:700;white-space:nowrap;"><td align="left" style="vertical-align:top;font-family:Tahoma;">Derek Ricciardi<span style="font-family:remialcxesans;font-size:1px;color:#FFFFFF;line-height:1px;"></span></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#5B6770;font-style:normal;font-weight:700;white-space:nowrap;"><tr style="font-size:20px;"><td align="left" style="vertical-align:top;font-family:Calibri;">Software Development Architect</td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#5B6770;font-style:normal;font-weight:700;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="padding:11px 0 0;vertical-align:top;font-family:Calibri;">Mid‑Hudson Valley Federal Credit Union</td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#5B6770;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">1099 Morton Blvd</td><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">, </td><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">Kingston</td><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">, </td><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;">NY</td><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;"> 12401</td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#5B6770;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:14.67px;"><td align="left" style="vertical-align:top;font-family:Calibri,Arial,sans-serif;"><a href="tel:845-336-4444%20X4909" target="_blank" id="LPlnk689713" style="text-decoration:none;color:#5B6770;"><strong style="font-weight:400;">845-336-4444 X4909</strong></a></td></tr></table></td></tr></table></td></tr></table></td></tr><tr style="font-size:0;"><td align="left" style="vertical-align:top;"><table cellpadding="0" cellspacing="0" border="0" style="font-size:0;color:#808080;font-style:normal;font-weight:400;white-space:nowrap;"><tr style="font-size:12px;"><td align="left" style="padding:11px 0 13px;vertical-align:top;font-family:Calibri,Arial,sans-serif;">This message and any included attachments are confidential, and are intended for the use of the addressee(s). <br />Unauthorized review, forwarding, printing, copying, distributing, or other such uses is strictly prohibited and <br />may be unlawful. If you received this message in error, or believe you are not authorized to receive it, <br />please promptly delete this message and notify the sender of the error.<br /></td></tr></table></td></tr></table></div></body>
</html>