ipsilon-client-install fix for missing PAOS AssertionConsumerService in SP metadata
One of the issues Jamie and I hit when testing ECP in Rippowan was the
fact ipsilon-client-install failed to add the PAOS
AssertionConsumerService to the SP metadata. The ECP transaction needs
to know about this SP endpoint. If it's not defined you'll get a 500
error with a message concerning an unknown provider, like many errors
the message percolated up from the bowels of lasso is not very helpful,
maybe someday we can get a better error message. In any event I opened a
ticket and have prepared a patch that needs review.
https://fedorahosted.org/ipsilon/ticket/162
For those of you who want to take a short cut and not redo your
ipsilon-client-install it's easy to add the missing metadata element to
/etc/httpd/saml2/metadata.xml, add this line, adjusted for your $HOST
right below the existing AssertionConsumerService line:
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
Location="https://$HOST/saml2/paosResponse" index="1"/>
Note, AssertionConsumerService are "indexed" endpoints, this is being
added as index 1.
--
John