Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The namespace and binding attributes attached to the <DiscoveryResponse> element are defined in the SAML V2.0 Identity Provider Discovery Protocol and Profile specification. The endpoint location is the return address for the SP, that is, where the Discovery Service returns to once the user's preferred IdP has been determined.

If your SP supports SAML V2SAML V2.0, and the SP is configured to use the SAML V2SAML V2.0 Identity Provider Discovery Protocol, you must configure metadata with your SP's metadata to include one or more <DiscoveryResponse> elements.

Configuring your SAML Service Provider Software

If your SP supports SAML V1SAML V1.1 only, you must configure your SP to use the legacy WAYF protocol, which is based on the proprietary Shibboleth 1Shibboleth 1.x AuthnRequest protocol. If your SP supports SAML V2SAML V2.0 only, you must configure your SP to use the SAML V2SAML V2.0 Identity Provider Discovery Protocol. In that case, you must configure SP metadata as described in the previous section.

Of course, if your SP supports both SAML V1SAML V1.1 and SAML V2SAML V2.0, you have a choice, but clearly SAML V2SAML V2.0 is preferred since it offers a much richer set of deployment options. Some SP implementations are sophisticated enough to make a runtime decison for you, based on the supported protocols called out in IdP metadata.

Instructions how to configure the Shibboleth SP for discovery will can be found elsewhere in this wiki.