I wrote a simple system with SP-initiating Web SSO scenario based on OIOSAML. To test the system, I deployed it on the remote host. However AssertionConsumerServiceURL
, where I specified URL, on which Shibboleth idP (idP based on Shibboleth) should return the answer is not called.
SAMLAssertionConsumer
- just a simple Java servlet. For a begin with, I just need to make sure that the response comes.
Generated AuthnRequest:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="http://ip-of-remote-system-here:8080/saml/consumer"
Destination="http://ip-of-identity-provider-here/idp/profile/SAML2/Redirect/SSO"
ForceAuthn="false"
ID="_068712cd-......163720312"
IsPassive="false"
IssueInstant="2014-07-12T06:42:16.673Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://ip-of-remote-system-here:8080</saml2:Issuer>
</saml2p:AuthnRequest>
if I make request to my servlet SAMLAssertionConsumer
direct:
http://ip-of-remote-system-here:8080/saml/consumer
Then it works. I would like to know how to properly configure the the assertion consumer service. That is the part of the SP-metadata, where I specify the assertion consumer.
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:esia="urn:esia:shibboleth:2.0:mdext" entityID="http://ip-of-remote-system-here:8080">
<md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>
MIID...XY7ZiQ==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:KeyDescriptor use="encryption">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>
MIID...XY7ZiQ==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://ip-of-remote-system-here:8080/saml/consumer" ResponseLocation="http://ip-of-remote-system-here:8080/saml/consumer"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://ip-of-remote-system-here:8080/saml/consumer" index="0" isDefault="true"/>
</md:SPSSODescriptor>
<md:AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
...
</md:AttributeAuthorityDescriptor>
<md:Organization>
...
</md:Organization>
<md:ContactPerson contactType="technical">
...
</md:ContactPerson>
<md:Extensions>
...
</md:Extensions>
</md:EntityDescriptor>
I would be very grateful for the information. Thanks to all.