How to get my SP to send a specific name ID format ?
Chad La Joie
lajoie at itumi.biz
Fri Jun 22 14:07:29 BST 2012
No idea, you'd have to check the list archives.
On 6/22/12 9:03 AM, Pete Newing wrote:
> Thanks for the info Chad.
> I saw in an earlier post that Scott was going to post an example... do
> you know if this ever happened as it would be very useful right about now!
> Thanks again,
> Regards, Pete
>
> On 22 June 2012 12:20, Chad La Joie <lajoie at itumi.biz
> <mailto:lajoie at itumi.biz>> wrote:
>
> You would use a special Session Initiator for that:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator#NativeSPSessionInitiator-SAML2SessionInitiator%28ProtocolHandler%29
>
> That allows you to set the request NameID format via an attribute on the
> <SessionInitiator>. Note, if they require more customization of the
> <AuthnRequest> that <SessionInitiator> will take a template
> <AuthnRequest> as a child and then you can add whatever random stuff
> they want to it.
>
> On 6/22/12 7:13 AM, Pete Newing wrote:
> > All,
> > I've installed a new 2.4.3 SP and, following the wiki instructions,
> > successfully tested it against TestShib Two.
> > I've now changed this to point to a clients commercial IdP and
> found an
> > issue with authentication.
> > The client is telling me that I need to provide a specific name ID
> > format in my SAML auth request.
> > I've had a look in the archives and the wiki and it looks like I
> need an
> > AuthnRequest.
> > But I can't see where I would put this in my shibboleth2.xml file?
> > Could someone point me in the right direction please... Thanks in
> advance...
> >
> > Here's a sanitized copy of the file....
> > <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
> > xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> > clockSkew="1800">
> >
> > <!-- Windows RequestMapper -->
> > <!-- The RequestMap defines portions of the webspace to protect;
> > mysp.example.com/ <http://mysp.example.com/>
> <http://mysp.example.com/> here. -->
> > <!--
> >
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap
> -->
> > <RequestMapper type="Native">
> > <RequestMap applicationId="default">
> > <Host name="mysp.example.com <http://mysp.example.com>
> <http://mysp.example.com>">
> > <Path name="/" authType="shibboleth"
> requireSession="true"/>
> > </Host>
> > </RequestMap>
> > </RequestMapper>
> >
> > <!-- The entityID is the name made for this SP. -->
> > <ApplicationDefaults
> entityID="https://mysp.example.com/shibboleth-sp"
> > REMOTE_USER="eppn persistent-id targeted-id">
> >
> > <!-- You should use secure cookies if at all possible. See
> > cookieProps in this Wiki article. -->
> > <!--
> >
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions -->
> > <Sessions lifetime="28800" timeout="3600" checkAddress="false"
> > relayState="ss:mem" handlerSSL="false">
> >
> > <!-- Triggers a login request directly to the myTargetIdP
> > IdP. -->
> > <!--
> >
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO
> -->
> > <SSO entityID="https://myTargetIdP.com/saml20">
> > SAML2 SAML1
> > </SSO>
> >
> > <!-- SAML and local-only logout. -->
> > <!--
> >
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout
> > -->
> > <Logout>SAML2 Local</Logout>
> >
> > <!--
> > Handlers allow you to interact with the SP and gather
> > more information. Try them out!
> > Attribute values received by the SP through SAML
> will be
> > visible at:
> > http://mysp.example.com/Shibboleth.sso/Session
> > -->
> >
> > <!-- Extension service that generates "approximate"
> metadata
> > based on SP configuration. -->
> > <Handler type="MetadataGenerator" Location="/Metadata"
> > signing="false"/>
> >
> > <!-- Status reporting service. -->
> > <Handler type="Status" Location="/Status"
> acl="127.0.0.1"/>
> >
> > <!-- Session diagnostic service. -->
> > <Handler type="Session" Location="/Session"
> > showAttributeValues="true"/>
> >
> > <!-- JSON feed of discovery information. -->
> > <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
> >
> > </Sessions>
> >
> > <!-- Error pages to display to yourself if something goes
> > horribly wrong. -->
> > <Errors supportContact="me at my-email.com
> <mailto:me at my-email.com>
> > <mailto:me at my-email.com <mailto:me at my-email.com>>"
> logoLocation="logo.jpg"
> > styleSheet="main.css"/>
> >
> > <!-- Loads and trusts a metadata file that describes
> MyTargetIdP
> > IdP and how to communicate with it. -->
> > <MetadataProvider type="XML"
> file="/etc/shibboleth/myTagetIdP.xml"/>
> >
> > <!-- Attribute and trust options you shouldn't need to
> change. -->
> > <AttributeExtractor type="XML" validate="true"
> > path="attribute-map.xml"/>
> > <AttributeResolver type="Query" subjectMatch="true"/>
> > <AttributeFilter type="XML" validate="true"
> > path="attribute-policy.xml"/>
> >
> > <!-- Your SP generated these credentials. They're used to
> talk
> > to IdP's. -->
> > <CredentialResolver type="File" key="sp-key.pem"
> > certificate="sp-cert.pem"/>
> >
> > </ApplicationDefaults>
> >
> > <!-- Security policies you shouldn't change unless you know what
> > you're doing. -->
> > <SecurityPolicyProvider type="XML" validate="true"
> > path="security-policy.xml"/>
> >
> > <!-- Low-level configuration about protocols and bindings
> available
> > for use. -->
> > <ProtocolProvider type="XML" validate="true" reloadChanges="false"
> > path="protocols.xml"/>
> >
> > </SPConfig>
> >
> > Regards, Pete
> >
> > *Peter L.K. Newing, CISSP, CISA, ITIL V3 Foundation, ISO 27001
> Lead Auditor*
> >
> > *Director of **Product Management*
> >
> > * *
> >
> > UK Mobile: +44 7545 073 406 <tel:%2B44%207545%20073%20406>
> <tel:%2B44%207545%20073%20406>
> > US Mobile: +1 424 789 0265 <tel:%2B1%20424%20789%200265>
> <tel:%2B1%20424%20789%200265>
> >
> >
> >
> > Flexeye Technology Ltd
> >
> >
> >
> > This email and any attachments are confidential and may be privileged.
> > If you have received it in error, do not read it, copy it, forward it,
> > disclose its contents or use it for any purpose. Please notify us
> > immediately and then delete it. Any views or opinions expressed are
> > solely those of the author and not necessarily those of Flexeye
> > Technology Ltd. This email was sent from Flexeye Technology Limited,
> > Hays House, Millmead, Guildford GU2 4HJ. Registered Office: Wey Court
> > West, Union Road, Farnham, Surrey GU9 7PT United Kingdom.
> Registered in
> > England No 4852559. VAT no GB 821 3432 66A
> >
> >
> >
> >
> > --
> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> <mailto:users-unsubscribe at shibboleth.net>
> >
>
> --
> Chad La Joie
> www.itumi.biz <http://www.itumi.biz>
> trusted identities, delivered
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> <mailto:users-unsubscribe at shibboleth.net>
>
>
>
>
> --
>
> *Peter L.K. Newing, CISSP, CISA, ITIL V3 Foundation, ISO 27001 Lead Auditor*
>
> *Director of **Product Management*
>
> * *
>
> UK Mobile: +44 7545 073 406
> US Mobile: +1 424 789 0265
>
>
>
> Flexeye Technology Ltd
>
>
>
> This email and any attachments are confidential and may be privileged.
> If you have received it in error, do not read it, copy it, forward it,
> disclose its contents or use it for any purpose. Please notify us
> immediately and then delete it. Any views or opinions expressed are
> solely those of the author and not necessarily those of Flexeye
> Technology Ltd. This email was sent from Flexeye Technology Limited,
> Hays House, Millmead, Guildford GU2 4HJ. Registered Office: Wey Court
> West, Union Road, Farnham, Surrey GU9 7PT United Kingdom. Registered in
> England No 4852559. VAT no GB 821 3432 66A
>
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
--
Chad La Joie
www.itumi.biz
trusted identities, delivered
More information about the users
mailing list