Versions Compared

Old Version 34

changes.mady.by.user Pieter van der Meulen

Saved on

compared with

New Version Current

changes.mady.by.user Thijs Kinkhorst

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: docs aanpassen aan realiteit

This page describes the differences between SURFconext and SURFsecureID that are relevant for a SAML service provider (SP) that is migrating from SURFconext to the SURFsecureID gateway, or that is using both simultaneously.Please note that SURFsecureID does not yet support OpenID Connect whereas SURFconext does. If you must use OpenID Connect, an OpenID Connect - SAML proxy may be an option (like

SaToSa).Note that this connecting to SURFsecureID directly is deprecated for the SURFsecureID test and production environments. 

Architecture

SURFconext (engine.surfconext.nl) and SURFsecureID (sa-gw.surfconext.nl) are both SAML proxies. The image below shows how SURFconext and SURFsecureID relate to each other.

...

Warning
titleSecurity advice

If your SP trusts multiple IdPs (e.g. SURFconext IdP and the SURFsecureID IdP), your SP must always verify from which IdP (the Issuer) it received the SAMLResponse. If your SAML library supports the IdP initiated flow (a.k.a unsolicited assertions), your SP could receive, and accept as valid, a SAMLResponse from any trusted IdP at any time.


...

titleSURFsecureID and OpenID Connect

...


Metadata

Because the SURFsecureID proxy is a separate SAML IdP from the normal SURFconext, it has different SAML 2.0 metadata. The EntityID, SAML signing certificate and Single Sign On Location are all different from the normal SURFconext.

...

The attributes you receive from SURFsecureID come from the SURFconext. SURFsecureID requires that your SP receives the eduPersonTargetedID (EPTI) attribute. If this attribute is not present, the authentication will fail at the SURFsecureID gateway.

...

titleeduPersonTargetedID (EPTI) is required
typeInfo

...

SURFsecureID are supplied by SURFconext.

Authentication Request

AssertionConsumerServiceIndex

...

  1. First level StatusCode urn:oasis:names:tc:SAML:2.0:status:Responder
    with second level StatusCode urn:oasis:names:tc:SAML:2.0:status:AuthnFailed: user canceled the authentication.
    or
  2. First level StatusCode urn:oasis:names:tc:SAML:2.0:status:Requester Responder 
    with second level StatusCode     urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext: authentication cannot be performed at the requested LoA. 

...