Google Apps integration

[Daniel A. Ramaley]

Hello again. Thank you to those who offered some advice when i posted 
last week. Since then i've backtracked just a bit and have been trying 
to learn more about releasing attributes. Specifically, i've been trying 
to release attributes to Test Shib Two (https://sp.testshib.org/), 
figuring that might be simpler than trying to release to Google Apps 
right away. I managed to release the eduPersonAffiliation and mail 
attributes from LDAP simply by uncommenting sections in the example 
attribute-filter.xml. But, i also want to release "mailuid" from LDAP; 
that attribute contains the username part of our e-mail addresses (for 
example, my mailuid is "daniel.ramaley"), which is what i'll need to 
ultimately release to Google Apps.

I added this to the AttributeResolver section of attribute-resolver.xml; 
i made it by copying the sample for "email" and making changes 
appropriately:
    <resolver:AttributeDefinition xsi:type="ad:Simple"
                                  id="mailuid"
                                  sourceAttributeID="mailuid">
        <resolver:Dependency ref="myLDAP" />
        <!-- The 1.3.6... number was taken from the LDAP schema. -->
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
                                   name="urn:oid:1.3.6.1.4.1.17501.666.100.122"
                                   friendlyName="mailuid" />
    </resolver:AttributeDefinition>
I then added this to the static connector, again in attribute-
resolver.xml:
        <dc:Attribute id="mailuid">
            <dc:Value>member</dc:Value>
        </dc:Attribute>

Finally, to the AttributeFilterPolicy that is releasing 
eduPersonAffiliation and mail, i added this:
        <afp:AttributeRule attributeID="mailuid">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

But, when i log into Test Shib Two, i don't see the mailuid being 
passed. Any ideas what i screwed up?

Thanks in advance,
Dan


On 2011-12-14 at 09:30:40, Mike Barton wrote:
>Hi Daniel,
>
>You can set your IDP to release any user attribute that you wish.
>
>If you look at the attribute-filter and attribute-resolver files you
>can follow the resolving sequence and then the release filtering
>sequence.
>
>It is not the email address that is released it just looks like that.
>The "@drake.edu" is the "scope" configured for your organisation
>which is preceded by your first and last name. Normally Shibboleth
>provides to a Federation service provider an attribute not a name, ie
>member at drake.edu or staff at drake.edu or even student at drake.edu as this
>is the required proof, post authentication, of the type of user
>requesting the resource from the SP. However some SP require more
>detailed info than the generic staff/student and so you configure
>your IDP to release a specific attribute.
>
>If you were not using Shibboleth, the NameID would be whatever you
>entered manually to access the Google apps. From your clip below you
>need to call from ldap the attribute you have stored in LDAP as the
>principal attribute and release it as NameID (attribute) to Google.
>You can configure your filter file to only release this attribute to
>Google and not just to everyone.
>
>I hope this clarifies it a little.
>
>Regards,
>Mike
>
>
>-----Original Message-----
>From: users-bounces at shibboleth.net
>[mailto:users-bounces at shibboleth.net] On Behalf Of Daniel A. Ramaley
>Sent: 14 December 2011 15:13
>To: users at shibboleth.net
>Subject: Google Apps integration
>
>I have a quick question about getting the Shibboleth IdP working with
>Google Apps. I'm a Shibboleth newbie, but have successfully gotten
>the IdP to work with TestShib Two, so i know the basic configuration
>is correct.
>
>According to Google' documentation[1], i need to configure Shibboleth
>to release the "principal attribute (encoded as a NameID)" to Google
>Apps. Any idea what the principal attribute is? Is that the person's
>e-mail address (that's what Google uses to identify people)? (And if
>so, is it a full address like "daniel.ramaley at drake.edu" or just the
>name part like "daniel.ramaley"?) Or is it something else? And what
>is NameID encoding?
>
>I asked these questions of Google support, but they told me it is not
>supported and suggested i ask this list. If anyone else has
>successfully configured Google Apps to work with their IdP, please
>let me know!
>
>Thanks in advance,
>Dan
>
>
>[1] https://code.google.com/apis/apps/articles/shibboleth2.0.html
__
Daniel A. Ramaley
Network Engineer 2

Dial Center 112, Drake University
2407 Carpenter Ave / Des Moines IA 50311 USA
Tel: +1 515 271-4540
Fax: +1 515 271-1938
E-mail: daniel.ramaley at drake.edu