Juniper Secure Access as a Shib/SAML SP

[Paul Riddle]

Sorry for the previous incomplete message.  I hit "send" by mistake.

On Thu, Apr 18, 2013 at 7:50 PM, Patrick Le <ple at jhmi.edu> wrote:

>  Does anyone have any experience integrating SAML 2.0 authentication
> against Juniper Secure Access with Shibboleth as the IDP?****
>

Yes, we're doing this.


>
>
> I’m having issues getting the Juniper appliance to pick up the userID from
> the attribute assertion. On the juniper appliance under the “Auth Server”
> configuration page, there is a “User Name Template” field where you’re
> supposed to define the attribute name for the userID. Examples given by
> juniper are:****
>
> ** **
>
> Example: <assertionNameDN.uid>, uid from X509SubjectName.
> The entire assertion name identifier if not specified; Or
> <userAttr.attr>, attr from AttributeStatement attributes.****
>
> ** **
>
> ** **
>
> I first tried to leave the field blank so that it gets the name identifier
> from the entire assertion. That allows me to login, but the UserID from the
> juniper logs is some random string of numbers which means nothing to us
> because we can’t correlate that back to an actual user. I tried various
> other methods like:****
>

I tried all of this too.  Never got attributes to work.  The only way I got
it to work was to use the Name Identifier.  In that case, you'll want to
leave the "User Name Template" field blank.

Do you have a "release transient ID to anybody" rule somewhere in your
attribute-filter.xml?  If so, you need to exclude the VPN, or it will
populate NameID with the aforementioned random string of numbers.  You'd
want to modify your release rule to look something like this:

    <AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <PolicyRequirementRule xsi:type="basic:NOT">
            <basic:Rule xsi:type="basic:OR">
                <basic:Rule xsi:type="basic:AttributeRequesterString"
value="https://newvpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1" />
                <basic:Rule xsi:type="basic:AttributeRequesterString"
value="https://vpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1" />
            </basic:Rule>
        </PolicyRequirementRule>

        <AttributeRule attributeID="transientId">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>

    </AttributeFilterPolicy>

Then, in attribute-resolver.xml, you need to set a definition up that
encodes your user ID as a SAML2 Name Identifier:

    <resolver:AttributeDefinition id="uidAsNameIdentifier"
        xsi:type="Simple"
        xmlns="urn:mace:shibboleth:2.0:resolver:ad">
        <resolver:Dependency ref="uid" />

        <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"

nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
    </resolver:AttributeDefinition>

Then in attribute-filter.xml, just set up a release rule:

    <AttributeFilterPolicy id="VPN">
        <PolicyRequirementRule xsi:type="basic:OR">
            <basic:Rule xsi:type="basic:AttributeRequesterString" value="
https://newvpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1" />
            <basic:Rule xsi:type="basic:AttributeRequesterString" value="
https://vpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1" />
        </PolicyRequirementRule>

        <AttributeRule attributeID="uidAsNameIdentifier">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>



>
>
> Juniper support has been less than helpful, so I’m hoping I’ll get better
> luck on the shib users list. ****
>
> If you need any further help setting up the Juniper side of things, feel
free to drop me an email.  I have lots of notes.

Hope this helps,
Paul
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130419/0013e1ac/attachment.html