<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-NL" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">Hello reader,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">We have a working setup with Shibboleth SP3 to authenticate against a broker. The AuthnRequest is unsigned at this moment.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">In the near future we have to use AuthnRequest with an embedded <Signature><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">I have no clue how to do it, at this moment. Can someone send me in de right direction?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">Where to look on the internet, a sample shibboleth2.xml config file, tips, hints.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">I have read https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334379/SigningEncryption, but I am still strugling<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">Peter Joosten<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">Unsigned autnrequest<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">---------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> AssertionConsumerServiceIndex="2"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> AttributeConsumingServiceIndex="1"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> Destination="https://eh.pre.signicat.nl/broker/sp/eh/1.9/login"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> ID="_45c3107705cd31eca7403b09d3b3f010"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> IssueInstant="2022-02-16T11:15:54Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> Version="2.0"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:DV:00000003309999999999:entities:0001</saml:Issuer><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <samlp:NameIDPolicy AllowCreate="1" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <samlp:RequestedAuthnContext Comparison="minimum"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:core:assurance-class:loa2</saml:AuthnContextClassRef><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> </samlp:RequestedAuthnContext><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"></samlp:AuthnRequest><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">Signedn autnrrequest (this is our goal)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">----------------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> AssertionConsumerServiceIndex="2"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> AttributeConsumingServiceIndex="1"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> Destination="https://eh.pre.signicat.nl/broker/sp/eh/1.11/login"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> ID="_45c3107705cd31eca7403b09d3b3f010"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> IssueInstant="2022-02-16T11:15:54Z"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> Version="2.0"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:SignedInfo><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:Reference URI=""><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:Transforms><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> </ds:Transforms><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:DigestValue>8P3ofQ4DX8dNbzEJv1UhRZec7gYlP6rh9R5f4tyafYs=</ds:DigestValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> </ds:Reference><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> </ds:SignedInfo><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <ds:SignatureValue>E/uC3m9jfH98D8IG9Rtqls+f8OYtv6oukrl7P3C259YyRtdhLkjFGADQ6iJuy10E<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">NrlMuJjoCWhhBdLpEQgLPxidbGEjwFNT3ec5YpnIN2mZNd2+/i4Ejrjx/i5PfpKo<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">EsOTIzbzaGdoIP6SF/1WVz5/+5TIl4qKo2mAqszsUQTk4TolP7Nl8FqCJQfD08Up<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">6Tpo0Sc8EL8TH1s+A9Uc1qaFe1A1pY8LUrfbnThvQlsTWqVF1VuYgjL1z2tYOCSw<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">cgnxjvh9M0kUhZgPVmAaKLiR3eg0RTPIpDVpO7OJlH1zvV/4eUuIgxbFNrF3GkF4<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000">eBWn7l91Ttq3LS8F/dBb6Q==</ds:SignatureValue><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> </ds:Signature><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:DV:00000003309999999999:entities:0001</saml:Issuer><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <samlp:NameIDPolicy AllowCreate="1" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <samlp:RequestedAuthnContext Comparison="minimum"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:etoegang:core:assurance-class:loa2</saml:AuthnContextClassRef><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"> </samlp:RequestedAuthnContext><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"></samlp:AuthnRequest><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black;mso-fareast-language:#2000"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="en-NL"><o:p> </o:p></span></p>
</div>
This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet,
Atos’ liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any
virus transmitted. On all offers and agreements under which Atos Nederland B.V. supplies goods and/or services of whatever nature, the Terms of Delivery from Atos Nederland B.V. exclusively apply. The Terms of Delivery shall be promptly submitted to you on
your request.
</body>
</html>