organizationalUnit attribute resolver breaks Google NameID

[Don Faulkner]

We've done several things in our IdP lately that have broken our Google Apps login. Today, I sat down to figure out what's going on.

Here's an example. If I edit attribute-resolver.xml to resolve organizationalUnit, attempts to login to gmail are met with "Invalid Email"

In the idp-process.log, I see the following


Without organizationalUnit resolution (google works):

17:26:17.668 - INFO [Shibboleth-Audit:970] - 20121016T222617Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|aoobokmhbpbgeecocphmjjbomdneeggcpddihjlp|google.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.uark.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_aaab02e2b9f6b4d5e2893976e1bb8bde|donf|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||donf|_ab0b97b7903624fc7131c6a059bc3c84,|


With organizationalUnit resolution (google fails):

17:21:19.915 - INFO [Shibboleth-Audit:970] - 20121016T222119Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|hfbphmjbhhpnilmgbdopmnklimcbpipjikjhlfcj|google.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.uark.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_27104b306c0c2b4e0d77cb56dd4a508e|donf|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_e1efc96c3a39693be819220f16e117d7|_a67c6dd0dcbf17a475c74914c42acc01,|



What was "donf" in the first log line is "_e1efc96c3a39693be819220f16e117d7" in the second. I think this is the problem. What I don't understand is what's causing it.

Also, a possibly-related question. Is there a "better" way to handle Google Apps instead of using a specific RelyingParty?



=== Relavent Configuration ==


My google metadata looks like:

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="google.com<http://google.com>">
    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                Location="https://www.google.com/a/gm.uark.edu/acs"/>
    </SPSSODescriptor>
</EntityDescriptor>



My relying-party.xml has the following:

<rp:RelyingParty id="google.com<http://google.com>"
        provider="https://idp.uark.edu/idp/shibboleth"
        defaultSigningCredentialRef="IdPCredential">
    <rp:ProfileConfiguration
            xsi:type="saml:SAML2SSOProfile"
            encryptAssertions="never" encryptNameIds="never" />
</rp:RelyingParty>



My attribute-resolver has the following:

<resolver:AttributeDefinition
        id="principal" xsi:type="PrincipalName"
        xmlns="urn:mace:shibboleth:2.0:resolver:ad">
    <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
            xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
</resolver:AttributeDefinition>


(and for organizationalUnit:

<resolver:AttributeDefinition xsi:type="ad:Simple"
        id="organizationalUnit" sourceAttributeID="ou">
    <resolver:Dependency ref="uarkLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML1String"
            name="urn:mace:dir:attribute-def:ou" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String"
            name="urn:oid:2.5.4.11" friendlyName="ou" />
</resolver:AttributeDefinition>



My attribute-filter.xml has the following:

<afp:AttributeFilterPolicy id="GoogleApps">
    <afp:PolicyRequirementRule
            xsi:type="basic:AttributeRequesterString"
            value="google.com<http://google.com>" />
    <afp:AttributeRule attributeID="principal">
        <afp:PermitValueRule xsi:type="basic:ANY" />
    </afp:AttributeRule>
</afp:AttributeFilterPolicy>




--
[me]
Don Faulkner, CISSP | IT Security<http://its.uark.edu/> at the University of Arkansas<http://www.uark.edu/>
contact>> donf at uark.edu<mailto:donf at uark.edu> | +1 (479) 575-2905
connect>> uarkITS on Facebook<http://www.facebook.com/uarkITS> | @uaits<http://twitter.com/uaits> | @dfaulkner<http://twitter.com/dfaulkner>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121016/68b8d161/attachment.html