different assertions generated for WEB and ACTIVE clients
Mauro Minella
Mauro.Minella at microsoft.com
Mon Jan 14 19:15:55 EST 2013
I federated my Shibboleth 2.3.8 with Office 365 following the guide on http://www.microsoft.com/en-us/download/details.aspx?id=35464.
Now I need some help to identify what I should check to make sure that the same assertions are sent to WEB clients and ACTIVE clients, because right now only the WEB clients work.
In fact, WEB clients generate the 2 pieces of information (NameID and IDPEmail) that should be received by the relying party (Office 365), tracked in idp-process.log:
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth"
SPNameQualifier="urn:federation:MicrosoftOnline">
WcwzuD50xEmCH3xsfbbeEA== (THIS IS michelle at shibbdomain.eduteamit.net<mailto:michelle at shibbdomain.eduteamit.net>'s OBJECT GUID)
</saml2:NameID>
<saml2:Attribute FriendlyName="UserId"
Name="IDPEmail"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsi="https://shibbidp.eduteamit.net/idp/shibboleth"
xsi:type="xs:string">
michelle at shibbdomain.eduteamit.net
</saml2:AttributeValue>
</saml2:Attribute>
23:07:44.653 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.
23:07:44.653 - INFO [Shibboleth-Audit:989] - 20130114T220744Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_be3dbbab-3c73-4c9e-b28e-d454d3cb7e63|urn:federation:MicrosoftOnline|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8b617a4a01b92a7d9830d18418d81a37|michela@shibbdomain.eduteamit.net|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,UserId,eduPersonTargetedID.old,ImmutableID,eduPersonTargetedID,|WcwzuD50xEmCH3xsfbbeEA==|_3ef09127e94722c764188b957d125394,|
When I use and ACTIVE client, instead, I receive a different token tracked in idp-process.log:
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth"
SPNameQualifier="urn:federation:MicrosoftOnline">
_3ee899df0e468beed1e88f9d7e47a1c9 (WHERE IS THIS STRING COMING FROM? THE USER IS THE SAME michelle at shibbdomain.eduteamit.net<mailto:michelle at shibbdomain.eduteamit.net>)
</saml2:NameID>
23:09:32.303 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.
23:09:32.303 - INFO [Shibboleth-Audit:989] - 20130114T220932Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_7420ec54-1dfb-454f-a32c-547723139e89|urn:federation:MicrosoftOnline|urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_b72b11fb59453efbca8ff389f23d6c19|michela||transientId,eduPersonScopedAffiliation,|_3ee899df0e468beed1e88f9d7e47a1c9|_3462d0090ac26e82b1b681060216bc33,|
MISSING USERID
As a matter of facts, when I run the Outlook wizard to configure the user (with IMAP or ActiveSync which are Active clients), it keeps asking the user password over and over.
I used Office365 metadata that are published on https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml, which should contain passive endpoint for WEB clients + active endpoint for rich e-mail client clients like Outlook:
<AssertionConsumerService isDefault="true" index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.microsoftonline.com/login.srf"/>
<AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://login.microsoftonline.com/login.srf"/>
Furthremore, as requested in the guide, I added the following part to web.xml
<security-constraint>
<display-name>Shibboleth IdP</display-name>
<web-resource-collection>
<web-resource-name>ECP</web-resource-name>
<url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>ShibUserPassAuth</realm-name>
</login-config>
Full assertions follow. I have no errors reported in the idp-process.log file, which lists 3500 lines for a single ECP or WEB call.
Mauro
THIS WORKS (WITH WEB CLIENT):
===============================================================
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth" SPNameQualifier="urn:federation:MicrosoftOnline">WcwzuD50xEmCH3xsfbbeEA==</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="87.24.1.141" InResponseTo="_be3dbbab-3c73-4c9e-b28e-d454d3cb7e63" NotOnOrAfter="2013-01-14T22:12:44.481Z" Recipient="https://login.microsoftonline.com/login.srf"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2013-01-14T22:07:44.481Z" NotOnOrAfter="2013-01-14T22:12:44.481Z">
<saml2:AudienceRestriction>
<saml2:Audience>urn:federation:MicrosoftOnline</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2013-01-14T22:07:44.356Z" SessionIndex="7e5d09aac0cc5cdf6a4872cb4a0ee5494eb689449e3cb2f560fcfd7aad52a999">
<saml2:SubjectLocality Address="87.24.1.141"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">member at shibbdomain.eduteamit.net</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="UserId" Name="IDPEmail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">michela at shibbdomain.eduteamit.net</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth" SPNameQualifier="urn:federation:MicrosoftOnline">rNIjb0eGUF9akyrG0BsHOoIZE6g=</saml2:NameID>
</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>
23:07:44.653 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.
23:07:44.653 - INFO [Shibboleth-Audit:989] - 20130114T220744Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_be3dbbab-3c73-4c9e-b28e-d454d3cb7e63|urn:federation:MicrosoftOnline|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8b617a4a01b92a7d9830d18418d81a37|michela@shibbdomain.eduteamit.net|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,UserId,eduPersonTargetedID.old,ImmutableID,eduPersonTargetedID,|WcwzuD50xEmCH3xsfbbeEA==|_3ef09127e94722c764188b957d125394,|
THIS DOES NOT WORK (WITH ACTIVE CLIENT OUTLOOK):
===============================================================
<saml2:Subject>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth">_3ee899df0e468beed1e88f9d7e47a1c9</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> 59CC33B83E74C449821F7C6C7DB6DE10
<saml2:SubjectConfirmationData Address="157.56.252.21" InResponseTo="_7420ec54-1dfb-454f-a32c-547723139e89" NotOnOrAfter="2013-01-14T22:14:32.225Z" Recipient="https://login.microsoftonline.com/login.srf"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2013-01-14T22:09:32.225Z" NotOnOrAfter="2013-01-14T22:14:32.225Z">
<saml2:AudienceRestriction>
<saml2:Audience>urn:federation:MicrosoftOnline</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2013-01-14T22:09:32.225Z">
<saml2:SubjectLocality Address="157.56.252.21"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">member at shibbdomain.eduteamit.net</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>
</soap11:Body>
</soap11:Envelope>
23:09:32.303 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.
23:09:32.303 - INFO [Shibboleth-Audit:989] - 20130114T220932Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_7420ec54-1dfb-454f-a32c-547723139e89|urn:federation:MicrosoftOnline|urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp|https://shibbidp.eduteamit.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_b72b11fb59453efbca8ff389f23d6c19|michela||transientId,eduPersonScopedAffiliation,|_3ee899df0e468beed1e88f9d7e47a1c9|_3462d0090ac26e82b1b681060216bc33,|
Thank you very much for any suggestions.
Mauro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130115/0a7888e4/attachment-0001.html
More information about the users
mailing list