Implementing SAML2 SP-initiated use case with Weblogic 10.3.4. and ADFS_问答_开发者

I am trying to implement the SP-initiated use case. For this what I have is:

Identity Provider: a Federation Service (Active Directory). For me is a "black box". The only thing that I am suppose to provide to this service is the name, url and home page of my application. Also I have to provide an XML with the metadata of my Service Provider.
Service Provider: Weblogic Server (10.3.4). Here I have configured a security realm, creating a Authentication Provider and a Credential Mapper Provider. Also I have configured the selected server (AdminServer) for working with the Service Provider role.

It is supposed that everything would be running ok, but I am at the same point than Barry (or at least is that I think...). When I request a "registered resource" (one of the apps that I have registered in our Federated Service system) the IDP doesn't answer me with the login form.

However with my Shibboleth set-up is working...

Any ideas?

I have been following these articles: http://biemond.blogspot.com/2009/09/sso-with-weblogic-1031-and-saml2.html, http://blogbypuneeth.wordpress.com/2011/01/15/steps-to-configure-saml-2-on-weblogic-server-10-3-0/ They are not the same use-case, but they have helped...

Thanks in advance,

Luis

By the way these are the actions I have done:

Domain: mydomain
Set up SAML2 debug options: EXTRA_JAVA_PROPERTIES="${EXTRA_JAVA_PROPERTIES} -Dweblogic.debug.DebugSecuritySAMLAtn=true -Dweblogic.debug.DebugSecuritySAMLLib=true -Dweblogic.debug.DebugSecuritySAML2Service=true -Dweblogic.debug.DebugSecuritySAML2CredMap=true -Dweblogic.debug.DebugSecuritySAML2Atn=true"
Configure SSL Weblogic Server (AdminServer). Default port 7002
Deploy app: myHost_domain_com_sample_weblogic_app_2
Note: in the domain SSO System the registered home page of this app is myHost.domain.com:7002/myHost_domain_com_sample_weblogic_app_2/
Test myHost.domain.com:7002/myHost_domain_com_sample_weblogic_app_2/
Test .../myHost_domain_com_sample_weblogic_app_2/default.jsp
Configure Security Realm: myrealm (default)
Create a new Authentication Provider: domain SAML2 AUTH PROVIDER; saml2identityasserter
In theory not necessary: reorder (Default Authentication JASS flag is REQUIRED)
Restart
Create a “New Web Single Sign On Identity Provider Partner” on domain SAML2 AUTH PROVIDER:
domain SSO Identity Provider Partner
/home/luis/Documents/domain_AUTH/FederationMetadata.xml File Descriptor of our Identity P开发者_Python百科rovider. We have removed the element (we have to take a deeper look at the OASIS SAML2 SPEC) At this point we should have got this message in the admin console: Partner created successfully. The partner has been disabled by default. You will need to complete its configuration manually then enable it.
Create a new Credential Mapping provider: SAML2_CMP; SAML2CredentialMapper
Reorder (not strictly necessary)
Restart
SAML2_CMP provider specific:
Issuer URI: myHost.domain.com
Name Qualifier: myHost.domain.com
Web Service Assertion Signing Key Alias: DemoIdentity
… Key Pass Phrase: DemoIdentityKeyStorePassPhrase
Generated Attributes
Restart
Create a New Web Single Sign On Provider Partner: domain SAML2 SERVICE PROVIDER PARTNER
Import /home/luis/Documents/domain_AUTH/FederationMetadata.xml At this point we should have got this message in the admin console: Partner created successfully. The partner has been disabled by default. You will need to complete its configuration manually then enable it.
Configure: Enabled, description, generate attributes
Set settings for domain SAML2 AUTH PROVIDER:
Enabled
Redirect URI'S: /myHost_domain_com_sample_weblogic_app_2/default.jsp
Configure the Server: AdminServer
SAML2 General:
Published Site URL: localhost:7001/saml2
Entity ID: myHost.domain.com
SAML2 Service provider: enabled

Now if I make a request to the Redirect URI nothing happens, I mean, I am able to access the protected resource without being authenticated.

However, if I include the URI of the Weblogic console, "/console/index.jsp", when I request this resource the Service Provider invokes the Identity Provider and I am asked for authentication (through login form).

Any ideas?

Thanks in advance,

Luis