Salesforce with Shibboleth IdP

[Chad La Joie]

Eric, did you move to an attribute query model as well or did you just
not worry about the lack of end-to-end confidentiality?

On Mon, Jun 11, 2012 at 2:16 PM, Eric Goodman <ericg at ucsc.edu> wrote:
> This is not really answering your direct question, but tangentially we had
> this issue with a different vendor.
>
> Our solution was to verify that the vendor's SAML client still verified the
> message signature. Knowing the signature was checked, that ssl was being
> used on all of the SAML transactions, and that the data being sent was
> relatively benign (ePPN in this case) we got the okay to integrate without
> encrypted assertions.
>
> --- Eric
>
>
> On Mon, Jun 11, 2012 at 10:33 AM, Keith Hazelton <hazelton at doit.wisc.edu>
> wrote:
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Warren,
>>
>> So that would leads me to ask Michael Chale--are you dropping Salesforce?
>>  If not, how are you addressing the conflict about encrypted vs.
>> unencrypted?
>>
>>       --Keith
>> ________________
>> On Jun 11, 2012, at 13:23:55, Curry, Warren wrote:
>>
>> > Andrew,
>> >
>> > I guess this response from Mike Chale at UF - College of Business was
>> > bounced back to him I am forwarding on to the list..  We had issue due to
>> > required encryption at UF.
>> > Warren
>> > ==================================.
>> >
>> > Good afternoon, Andrew
>> >
>> >
>> > We tried to use Shibboleth as an IdP but ran into a few stumbling
>> > blocks, one of which was a show-stopper - Salesforce cannot handle encrypted
>> > responses from the IdP and our university's current policy is to only
>> > provide encrypted responses.
>> >
>> > If you would like to discuss any further details I would be happy to
>> > help you out.
>> >
>> >
>> >  Michael Chale
>> >  Solutions Engineer
>> >  Technology Solutions
>> >
>> > -----Original Message-----
>> > From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>> > On Behalf Of Andrew Morgan
>> > Sent: Monday, June 11, 2012 12:52 PM
>> > To: Shib Users
>> > Subject: Re: Salesforce with Shibboleth IdP
>> >
>> > On Fri, 8 Jun 2012, Peter Schober wrote:
>> >
>> >> * Andrew Morgan <morgan at orst.edu> [2012-06-07 18:42]:
>> >>>   Login Error
>> >>>   Your login attempt using single sign-on with an identity provider
>> >>>   certificate has failed. Please contact your salesforce.com
>> >>> administrator
>> >>>   for more information.
>> >>
>> >> If all else fails you could try just that?
>> >> -peter
>> >
>> > Unfortunately, my co-worker is the administrator and we are both trying
>> > to understand what is going wrong!  :)
>> >
>> > We have tried using Salesforce's SAML assertion validator, but that
>> > doesn't raise any errors.  I was hoping someone might have experience with
>> > Salesforce, or at least have a working Shibboleth-Salesforce setup that I
>> > could compare against.
>> >
>> > Thanks,
>> >       Andy
>> > --
>> > To unsubscribe from this list send an email to
>> > users-unsubscribe at shibboleth.net
>> > --
>> > To unsubscribe from this list send an email to
>> > users-unsubscribe at shibboleth.net
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
>> Comment: GPGTools - http://gpgtools.org
>>
>> iQEcBAEBAgAGBQJP1ivXAAoJEPXbVHOlscTvm3MIAMCMEtbX82PVB2XKce1qK3j8
>> zRK3q9Hz/9BfFWDScq5sMPFrmMicmhZiq59D+RCAshDOYmT/QpZ+81ciggCRLrlO
>> cN8UfpUhQ5cZ4YYAXCrlsI+GY7k3zksIJpPIwDGBnA6mhlHfd0ed91HeY/mIUNnE
>> C6zrP9lXiRDrWRWuwXJyYV8lEAUc3YHDzOColZQwZp7PIHZkLeij90lXDC5axrNr
>> +LeFPD/YQd3WNJ3dJ9RjDJTuS6wnRfQT3UpwGxuXM+bKNBuS2AS3uHfU9zTehQd4
>> 6vXEbkVLhivFjxZPwO2+3qSXBHq7xhi0PrNu1mWixesUPXNyMOQoSvuO7jRNqGc=
>> =3tCg
>> -----END PGP SIGNATURE-----
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered