0

I wrote a simple system with SP-initiating Web SSO scenario based on OIOSAML. To test the system, I deployed it on the remote host. However AssertionConsumerServiceURL, where I specified URL, on which Shibboleth idP (idP based on Shibboleth) should return the answer is not called.

SAMLAssertionConsumer - just a simple Java servlet. For a begin with, I just need to make sure that the response comes.

Generated AuthnRequest:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
    AssertionConsumerServiceURL="http://ip-of-remote-system-here:8080/saml/consumer" 
    Destination="http://ip-of-identity-provider-here/idp/profile/SAML2/Redirect/SSO" 
    ForceAuthn="false" 
    ID="_068712cd-......163720312" 
    IsPassive="false" 
    IssueInstant="2014-07-12T06:42:16.673Z" 
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://ip-of-remote-system-here:8080</saml2:Issuer>
</saml2p:AuthnRequest>

if I make request to my servlet SAMLAssertionConsumer direct:

http://ip-of-remote-system-here:8080/saml/consumer

Then it works. I would like to know how to properly configure the the assertion consumer service. That is the part of the SP-metadata, where I specify the assertion consumer.

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:esia="urn:esia:shibboleth:2.0:mdext" entityID="http://ip-of-remote-system-here:8080">
    <md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor use="signing">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>
                        MIID...XY7ZiQ==
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:KeyDescriptor use="encryption">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>
                        MIID...XY7ZiQ==
                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>

     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"  Location="http://ip-of-remote-system-here:8080/saml/consumer" ResponseLocation="http://ip-of-remote-system-here:8080/saml/consumer"/>
     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://ip-of-remote-system-here:8080/saml/consumer" index="0" isDefault="true"/>

    </md:SPSSODescriptor>
    <md:AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
       ...
    </md:AttributeAuthorityDescriptor>
    <md:Organization>
       ...
    </md:Organization>
    <md:ContactPerson contactType="technical">
      ...
    </md:ContactPerson>
    <md:Extensions>
      ...
    </md:Extensions>
</md:EntityDescriptor>

I would be very grateful for the information. Thanks to all.

1 Answer 1

0

The problem was different. Was used incorrect keystore. Now everything is OK.

Initially, I assumed that entityID attribute must refer to a domain name, which specified in attributes Location. However, it is not. It just must be unique and it is better to use domain name for that.

UnderstandingShibboleth, EntityNaming:

Shibboleth identity and service providers are used in SAML deployments, and as such, they are assigned a unique name known as an "entityID".

Metadata for the OASIS Security Assertion Markup Language (SAML)V2.0, 2.3.2 Element :

entityID [Required] -

 Specifies the unique identifier of the SAML entity whose metadata is 
 described by the element's contents.

UnderstandingShibboleth, EntityNaming:

Strongly recommended NOT to use the physical hostname of a server running Shibboleth as the entityID. As time passes, things get moved and that deployment may not always live on the same box.

Additionally there may be multiple logical deployments of Shibboleth on a single physical server, each requiring their own unique entityID, so using the server's name doesn't scale beyond a single one.

In the sandbox can be use physical addresses.

You must log in to answer this question.