configuring metadata for Net+ Box SP

[Douglas E. Engert]

On 6/5/2013 8:15 AM, Rob Gorrell wrote:
> We are a brand new sign up to the Net+ Box service and are beginning our implementation/roll-out of which Shibboleth SSO is a large part of. I had my initial SSO talk with Box just the other day where
> there are a few things I'm not used to on the IdP configuration side I wanted to ask about. Admittedly, the majority of our campus' work with shibb has been on the IdP side and in the context of
> federation. I understand Box is not yet there with being able to deal with the InCommon metadata, so instead a more direct pairing of IdP + SP is needed. So my question is around the correct setup for
> the Box SP metadata in my IdP? Box mentioned something that was new to me... that they did not use certificates to sign their metadata as is typical of the shibb world, so we would need to give the
> IdP an exception to not worry about unsigned metadata (there was some mention they could sign if they had to, but would prefer for us to make the exception). Is anyone familiar with this, how to set
> it up, or what the Box metadata should look like? I think I can handle the appropriate attribute mappings once I'm able to get the metadata and relying-party set up correctly. any examples you're
> willing to share would be much appreciated.
>

We are still testing box. They did send us a URL:

https://spaces.internet2.edu/display/NetPlusIDG/BoxIDG

In the Attributes section the refer to the "Recommended SAML Attribute Name"
as urn:oid:1.3.6.1.4.1.5923.1.1.1.6 This is the OID for ePPN.

They want to use it as both a username and as an actual e-mail address.
There are a lot of issues with this.
Our user's e-mail addresses don't all match the ePPN. Some users have
multiple e-mail addresses too. Some ePPNs are not e-mail addresses.
We may reconsider what we send to box.

There is also a URL of the Box metadata, boxsamplemetadata-091311.xml
in the document.

After reformatting the metadata to make it readable, the only change we added was

--- ,boxsamplemetadata-091311.xml       2013-02-21 14:59:30.000000000 -0600
+++ boxsamplemetadata-091311.xml        2013-02-21 15:04:49.000000000 -0600
@@ -46,7 +46,7 @@
      </ds:KeyInfo>
    </ds:Signature>
    <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-    <md:KeyDescriptor use="signing">
+    <md:KeyDescriptor>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <ds:X509Data>

That says its OK for the IDP to use the certificate for encrypted assertions
in addition to box signing requests. The accept the encrypted assertions.

>
> -Rob
>
> --
> Robert W. Gorrell
> Middleware Engineer, Identity and Access Management
> University of NC at Greensboro
> 336-334-5954
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444