Shibboleth IDP and ADFS federation claim problem

[THIA Jean-Marie]

So your ADFS is a gateway between your IdP and your application. This means that you have to configure the claim provider for the Idp and the relaying party for your app. Follow the ... incommon federation ( forgot the exact title) guide on TechNet to deal with the claims mapping.

Envoyé depuis un mobile
________________________________
De : Renzo De Renzi
Envoyé : 09/10/2012 07:58
À : Shib Users
Objet : Re: Shibboleth IDP and ADFS federation claim problem


Il giorno 07/ott/2012, alle ore 20:31, Cantor, Scott ha scritto:

> There are few similarities between the very standards-based SAML attribute
> profiles used by Shibboleth and the proprietary, often fundamentally
> incorrect, approaches to attribute naming used by ADFS. If you want to use
> ADFS as an SP, you have to adjust the IdP or the ADFS side to use one or
> the other, and that can be very complex on the ADFS side.
>
> Some of this is discussed in the wiki in the CommercialInterop topic.
>
> You have to start by determining how you intend to name attributes in SAML
> and work from that to what configuration changes are needed.
>
> If you follow up with some information on what attributes you want to
> exchange, and then which end you want to adjust, then there are more
> specific examples available.
>
> -- Scott

Thanks for your prompt answer, this is my policy taken from attribute-filter-xml file, it already works correctly between Shibboleth IDP and SP on the same machine:

<!-- my policy -->
    <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="givenName">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="surname">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="organizationalUnitName">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="uid">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121009/9103eb77/attachment.html