Google Apps integration

[Roberto Ullfig]

This is what we have, do not release Transient ID to Google. We
un-commented the first one below and then explicitly release transient
ID to everyone else.

- attribute-filter.xml:

<!--  Release the transient ID to anyone -->
<!--
    <AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <PolicyRequirementRule xsi:type="basic:ANY" />

        <AttributeRule attributeID="transientId">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>

    </AttributeFilterPolicy>
-->

<!-- Google Apps --><!-- Do not release transientID to google.com -
things break -->    <AttributeFilterPolicy id="google.com">
<PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="google.com" />        <AttributeRule attributeID="principal">
<PermitValueRule xsi:type="basic:ANY" /> </AttributeRule>
</AttributeFilterPolicy>

- attribute-resolver.xml:

<!-- for google.com -->
    <resolver:AttributeDefinition id="principal"
xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
    <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
        nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
    </resolver:AttributeDefinition>

relying-party.xml (this might have been wrong to do but we left it in):

    <RelyingParty id="google.com"
        provider="https://shibboleth.uic.edu/shibboleth"
        defaultSigningCredentialRef="IdPCredential"
        defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
        <ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
        <ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile" />
        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />
        <ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" />
    </RelyingParty>

This was configured a couple of years ago. I don't recall why
relying-party was configured for google.com. Can someone explain how
to move the info in relying party elsewhere or why we would have
inserted that in the first place?
On Wed, Dec 14, 2011 at 9:12 AM, Daniel A. Ramaley
<daniel.ramaley at drake.edu> wrote:
> I have a quick question about getting the Shibboleth IdP working with
> Google Apps. I'm a Shibboleth newbie, but have successfully gotten the
> IdP to work with TestShib Two, so i know the basic configuration is
> correct.
>
> According to Google' documentation[1], i need to configure Shibboleth to
> release the "principal attribute (encoded as a NameID)" to Google Apps.
> Any idea what the principal attribute is? Is that the person's e-mail
> address (that's what Google uses to identify people)? (And if so, is it
> a full address like "daniel.ramaley at drake.edu" or just the name part
> like "daniel.ramaley"?) Or is it something else? And what is NameID
> encoding?
>
> I asked these questions of Google support, but they told me it is not
> supported and suggested i ask this list. If anyone else has successfully
> configured Google Apps to work with their IdP, please let me know!
>
> Thanks in advance,
> Dan
>
>
> [1] https://code.google.com/apis/apps/articles/shibboleth2.0.html
>
> __
> Daniel A. Ramaley
> Network Engineer 2
>
> Dial Center 112, Drake University
> 2407 Carpenter Ave / Des Moines IA 50311 USA
> Tel: +1 515 271-4540
> Fax: +1 515 271-1938
> E-mail: daniel.ramaley at drake.edu
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



-- 
Roberto Ullfig - ACCC - rullfig at uic.edu