Juniper Secure Access as a Shib/SAML SP

[Christopher Bongaarts]

On 4/19/2013 3:11 PM, Paul Riddle wrote:
> Do you have a "release transient ID to anybody" rule somewhere in your
> attribute-filter.xml?  If so, you need to exclude the VPN, or it will
> populate NameID with the aforementioned random string of numbers.  You'd
> want to modify your release rule to look something like this:

Alternatively, you can Deny all values of transient ID within the permit 
policy:

>     <AttributeFilterPolicy id="VPN">
>         <PolicyRequirementRule xsi:type="basic:OR">
>             <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://newvpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1" />
>             <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://vpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1" />
>         </PolicyRequirementRule>
>
>         <AttributeRule attributeID="uidAsNameIdentifier">
>             <PermitValueRule xsi:type="basic:ANY" />
>         </AttributeRule>

   <AttributeRule attributeID="transientId">
     <DenyValueRule xsi:type="basic:ANY" />
   </AttributeRule>

>     </AttributeFilterPolicy>

I prefer doing it this way because we organize our filter policies by 
SP, and this allows us to keep the exception together with the rest of 
the SP's rules.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%