Google Apps integration

[Daniel A. Ramaley]

On 2011-12-21 at 11:02:43, Peter Schober wrote:
>* Daniel A. Ramaley <daniel.ramaley at drake.edu> [2011-12-21 17:49]:
>> But, when i log into Test Shib Two, i don't see the mailuid being
>> passed. Any ideas what i screwed up?
>
>Some common steps:
>
>First have a look at your IdP logs to make sure you actually sent the
>attribute (idp-audit.log, the format is explained in the
>documentation).
>
>Then check https://sp.testshib.org/Shibboleth.sso/Session after
>logging in to TestShib, to see what the Shib SP there successfully
>mapped.
>
>Finally, TestShib won't have a mapping rule for the specific attribute
>you sent (since it's not a standard attribute but from your own
>namespace) and hence doesn't know what to do with it.

I checked the idp-audit.log, and can see that mailuid was being sent to 
TestShib. Great! I also checked the logs on TestShib and can see that 
the mailuid data was received.

But if mailuid is something custom, i guess that explains why it didn't 
show up in the GUI on TestShib. That explains it. I didn't know that 
mailuid was just something we made up (i inherited the LDAP from someone 
who is now retired), and also didn't know that TestShib needed to have a 
specific mapping to display data it receives.

Anyway, i've seen enough to believe that my IdP is in fact able to pull 
mailuid data from LDAP. That's all i wanted to accomplish with TestShib.

Thank you so much for the explanation!

>* James Bardin <jbardin at bu.edu> [2011-12-21 17:55]:
>> Google doesn't ready any attributes, only the Subject NameID. That's
>> where you need to put the username or email.
>
>Yes, so the next step would either be to put the value of your mailuid
>attribute into some standard attribute so make sure it's being mapped
>properly at TestShib, or to attach a NameID encoder to it (as
>described in the documentation and can be seen in the attribute
>resolver examples) and send it to the Google SP.

I'll see what i can do to NameID encode it and send it to Google.

On 2011-12-21 at 11:23:57, Roberto Ullfig wrote:
>This is what we have, do not release Transient ID to Google.

Yep, i'm not releasing Transient ID. I found a mailing list post that 
told me about that.

>- attribute-filter.xml:

Your file looks like the Google documentation, and like my file.

>- attribute-resolver.xml:

Again, it looked like the documentation and like what i have.

I'm not sure how to change it to do what i need, though. I'm not sure 
what LDAP attribute it pulls, or how to change it to mailuid. I tried
just adding a sourceAttributeID and setting a dependency, but that
didn't work:

    <resolver:AttributeDefinition id="principal"
                                  xsi:type="PrincipalName"
                                  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  sourceAttributeID="mailuid">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder
           xsi:type="SAML2StringNameID"
           xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
           nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-
format:unspecified" />
    </resolver:AttributeDefinition>

>relying-party.xml (this might have been wrong to do but we left it
>in):

You modified this from the current Google documentation. I'm not sure if 
i'll need to make the same modifications; i'll try to figure out how to
get it to send mailuid first and worry about changing this file if it 
still doesn't work.

Thanks for all the thoughts so far. I'm probably close; i'm just missing
the piece where i figure out how to get the mailuid from LDAP to be sent
to Google.

__
Daniel A. Ramaley
Network Engineer 2

Dial Center 112, Drake University
2407 Carpenter Ave / Des Moines IA 50311 USA
Tel: +1 515 271-4540
Fax: +1 515 271-1938
E-mail: daniel.ramaley at drake.edu