DiscoveryResponse

Since 2025-03-12 SeamlessAccess.org is checking that the returnurl is part of one of the DiscoveryResponse in SP metadata.

If you see a box with "Unable to verify returning website" the URL:s ar not matching more info SeamlessAccess webpage.

How to fix the problem ?

Shibboleth SP

  1. Download new metadata from https://<sp>/Shibboleth.sso/Metadata
  2. Import into Metadata.swamid.se  
  3. "Merge from published"
  4. "Request publication"

Satosa

  1. Fetch backend.xml
    1. If you are running docker.sunet.se/satosa you copy from /etc/satosa/metadata/backend.xml
    2. Others will have to run satosa-saml-metadata proxy_conf.yaml ${DATA_DIR}/metadata.key ${DATA_DIR}/metadata.crt --dir /tmp and then fetch /tmp/backend.xml
  2. Import into Metadata.swamid.se 
  3. "Merge from published"
  4. "Request publication"

Manually edit in Metadata.swamid.se

If you can't get hold of the metadata or metadata doesn't contain  DiscoveryResponse you kan always manually add it in Metadata.swamid.se

Find out what URL to add

  1. Run a loginflow via SeamlessAccess.org
  2. Check the URL. Should look like "https://service.seamlessaccess.org/ds/?entityID=https%3A%2F%2Frelease-check.swamid.se%2Fshibboleth&return=https%3A%2F%2Frelease-check.swamid.se%2FShibboleth.Sso%2FDS%2Fseamless-access%3FSAMLDS%3D1%26target%3Dss%253Amem%253A4ddbae64f51c70036e5af8c8955a08cb36f6a18620103a2515c7f6878744d863"
  3. Copy the return parameter (https%3A%2F%2Frelease-check.swamid.se%2FShibboleth.Sso%2FDS%2Fseamless-access%3FSAMLDS%3D1%26target%3Dss%253Amem%253A4ddbae64f51c70036e5af8c8955a08cb36f6a18620103a2515c7f6878744d863 in this case)
  4. URLdecode (gets https://release-check.swamid.se/Shibboleth.Sso/DS/seamless-access?SAMLDS=1&target=ss%3Amem%3A4ddbae64f51c70036e5af8c8955a08cb36f6a18620103a2515c7f6878744d863)
  5. Some SP:s like Shibboleth add uniq info at the end after a ?, remove that to get the base of DiscoveryResponse (gets https://release-check.swamid.se/Shibboleth.Sso/DS/seamless-access)
  6. Copy this URL

Standard URL:s

The following URL:s ar the default we have found for different softwares. Use them as suggestions / to verify the URL you got above

  • Shibboleth - https://<sp>/Shibboleth.sso/Login
  • Satosa - https://<sp>/Saml2SP/disco
  • SimpleSAMLphp - https://<sp>/simplesaml/module.php/saml/sp/discoresp.php
  • Canvas - https://<sp>/login/saml

Update SP

  1. Login to  Metadata.swamid.se
  2. Create a Draft from your SP
  3. Click on the pen besides DiscoveryResponse
  4. "Add Index"
  5. Add the URL
  6. "Request publication"


  • No labels