Releasing NameID using Shibboleth 3 for Concur

[Daniel Conner]

We are working on configuring SSO for Concur. We are using. We followed the
instructions, but am not sure why the SSO is failing. The url we are using
is
https://our-idp-host.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://implementation.concursolutions.com.
The url brings up our login page. The login portion against our ldap is
working in that if I enter a bogus username and password, I am prompted to
enter a correct password. When I use valid credentials, I am forwarded to:
https://implementation.concursolutions.com/?result=InvalidXML

I included my applicable configuration with you all below including:
attribute-resolver.xml, relying-party.xml, metadata-providers.xml,
saml-nameid.xml, and saml-nameid.properties. Any help would be greatly
appreciated.

ATTRIBUTE-RESOLVER.XML

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="ConcurID"
sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder
             xsi:type="enc:SAML2StringNameID"
            
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
        />
    </resolver:AttributeDefinition>

ATTRIBUTE-FILTER.XML
          <AttributeFilterPolicy id="releaseToConcur">
             <PolicyRequirementRule xsi:type="Requester"
value="https//implementation.concursolutions.com/SAMLRedirector/ClientSAMLLogin.aspx"
/>
             <AttributeRule attributeID="ConcurID">
                   <PermitValueRule xsi:type="ANY" />
             </AttributeRule>
          </AttributeFilterPolicy>

RELYING-PARTY.XML

        <bean parent="RelyingPartyByName"
c:relyingPartyIds="https://implementation.concursolutions.com">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:encryptionOptional="true" p:signAssertions="true" />
                </list>
            </property>
        </bean>

METADATA-PROVIDERS.XML

  <MetadataProvider id="ConcurAVC" xsi:type="FilesystemMetadataProvider"
        metadataFile="%{idp.home}/metadata/concur-test-metadata.xml">
  </MetadataProvider>


SAML-NAMEID.XML
    
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        





        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
           <!--
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"-->
           p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />


    </util:list>


SAML-NAMEID.PROPERTIES
# Comment out to disable legacy NameID generation via Attribute Resolver
idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator
#idp.nameid.saml1.legacyGenerator =
shibboleth.LegacySAML1NameIdentifierGenerator









--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Releasing-NameID-using-Shibboleth-3-for-Concur-tp7632696.html
Sent from the Shibboleth - Developers mailing list archive at Nabble.com.