WebEx

[Schwoerer, Bradley J]

Joy,

I think some things have changed that would make this easier, but this is
what we had to do at the time (about a year ago).  We are doing webex
specific attributes as the nameFormat that they accepted was the
"unspecified" type.  The main thing for the auto-privisioning and the
updating was getting a timestamp field "updateTimeStamp" which we are
using the last login time.  I didn't handle any of the webex side, so I
can't answer those questions.

-Bradley



<AttributeFilterPolicy id="releaseToWebEx">
        <PolicyRequirementRule xsi:type="basic:OR">
<basic:Rule xsi:type="basic:AttributeRequesterString"
value="http://www.webex.com"/>
        </PolicyRequirementRule>

        <AttributeRule attributeID="webex-uid">
            <PermitValueRule xsi:type="basic:ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="webex-givenName">
            <PermitValueRule xsi:type="basic:ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="webex-sn">
            <PermitValueRule xsi:type="basic:ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="webex-mail">
            <PermitValueRule xsi:type="basic:ANY"/>
        </AttributeRule>
        <AttributeRule attributeID="webex-nameid">
            <PermitValueRule xsi:type="basic:ANY"/>
        </AttributeRule>
    </AttributeFilterPolicy>


<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-uid"
sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:DisplayName xml:lang="en">User ID</resolver:DisplayName>
        <resolver:DisplayDescription xml:lang="en">User name of a person
mainly used for on campus resources</resolver:DisplayDescription>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="uid"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple"
id="webex-givenName" sourceAttributeID="givenName">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:DisplayName xml:lang="en">Given
name</resolver:DisplayName>
        <resolver:DisplayDescription xml:lang="en">Given name of a
person</resolver:DisplayDescription>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="firstname" 
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-sn"
sourceAttributeID="sn">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:DisplayName xml:lang="en">Surname</resolver:DisplayName>
        <resolver:DisplayDescription xml:lang="en">Surname or family
name</resolver:DisplayDescription>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="lastname" 
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-mail"
sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:DisplayName xml:lang="en">E-mail</resolver:DisplayName>
        <resolver:DisplayDescription xml:lang="en">Campus email address
for a person</resolver:DisplayDescription>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="email"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
    </resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-update"
sourceAttributeID="loginTime">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="updateTimeStamp"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"/>
    </resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-nameid"
sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAP"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"/>
    </resolver:AttributeDefinition>










On 6/30/12 6:51 PM, "Joy Veronneau" <jv11 at cornell.edu> wrote:

>Hi, I am working on configuring our shibboleth IdP to work with WebEx-
>has anyone done this? We have got the authentication working correctly
>but we are unsure how to set up authorization with auto account creation.
>I would be interested in talking to someone who has this working.
>
>Thanks-
>
>-- Joy
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net