Google Apps using Shibboleth

[Christopher Bongaarts]

On 12/3/2012 10:58 AM, Prasanna wrote:
> Dear Christopher,
>
> Thanks for your reply. Please find the text version of my config files.
>
> *Attribute filter:*
>
> <afp:AttributeFilterPolicy id="google.com">
>           <afp:PolicyRequirementRule
> xsi:type="basic:AttributeRequesterString" value="google.com" />

The above value should match the one in the next rule 
(google.com/a/imperoidm.com):

> <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
>           <afp:PolicyRequirementRule xsi:type="basic:NOT">
>                   <basic:Rule xsi:type="basic:AttributeRequesterString"
> value="google.com/a/imperoidm.com" />

The purpose of the second rule is to NOT release the transientID to 
google.  If you did, the IdP would randomly set the NameID to either the 
principal or the transientID (at least, that was the behavior last time 
I checked).

> *Relying party*
>
> <rp:RelyingParty id="google.com"

This id needs to match the Google entityID (google.com/a/imperoidm.com) 
in order for it to take effect.  Without it, it will fall back on the 
settings for the default relying party.

> xsi:type="resource:FilesystemResource" file="C:\Program Files
> (x86)\Internet2\Shib2Idp/metadata/imperoidm-metadata.xml"/>

I'm not sure how flexible Shib is in parsing paths, but I would be 
careful about mixing forward and backslashes in pathnames...  I think 
your IdP would throw an error at startup if it couldn't read it, though.

> *Google metedata*
> <EntityDescriptor entityID="google.com"

My configuration with Google uses the google.com/a/imperoidm.com form 
for the EntityID.  This affects some of the data in the SAML response.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%