Salesforce with Shibboleth IdP

[Andrew Morgan]

On Mon, 11 Jun 2012, Andrew Morgan wrote:

> On Fri, 8 Jun 2012, Peter Schober wrote:
>
>> * Andrew Morgan <morgan at orst.edu> [2012-06-07 18:42]:
>>>    Login Error
>>>    Your login attempt using single sign-on with an identity provider
>>>    certificate has failed. Please contact your salesforce.com administrator
>>>    for more information.
>>
>> If all else fails you could try just that?
>> -peter
>
> Unfortunately, my co-worker is the administrator and we are both trying to
> understand what is going wrong!  :)
>
> We have tried using Salesforce's SAML assertion validator, but that
> doesn't raise any errors.  I was hoping someone might have experience with
> Salesforce, or at least have a working Shibboleth-Salesforce setup that I
> could compare against.

Success!

We had configured Salesforce to use the 'uid' attribute as the Federation 
ID parameter.  When I had my co-worker sitting next to me, we ran a SAML 
assertion through Salesforce's validator.  It said it was unable to map 
the subject to a Salesforce user.

I went back into Shibboleth and configured the 'uid' attributes as a SAML2 
NameID, and my co-worker configured Salesforce to use the Subject NameID 
as the Federation ID.  This worked!

I'm not sure if I had something mis-configured in Shibboleth or if 
Salesforce couldn't read the 'uid' attribute in the SAML assertion for 
some reason.

I'm very new to Shibboleth - is there an attribute lookup service or are 
all the attributes released via the SAML assertion payload?

BTW, I am using the following config in relying-party.xml:

     <rp:RelyingParty id="https://saml.salesforce.com" provider="https://login.oregonstate.edu/idp-dev/shibboleth" defaultSigningCredentialRef="IdPCredential">
         <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true"
                                  assertionLifetime="PT5M" assertionProxyCount="0"
                                  signResponses="never" signAssertions="always"
                                  encryptAssertions="never" encryptNameIds="never"/>
     </rp:RelyingParty>


I also modified Salesforce's metadata file by setting:

   AuthnRequestsSigned="false"


Thanks,
 	Andy