Shibboleth IdP integration with Oracle 11g Identity Federation

[Kevin P. Foote]

On Mon, 25 Mar 2013, lalithj wrote:

> whether it is a must in SP side or whether can SP change it unless it is
> really required.

We never tried to change it on the SP side.. easier to deliver from the
IdP.

> If we are to change in IdP side, what is the best way to handle it without
> impacting currently integrated SPs,

You can send / release NameID based on the entity that the request came
from. So first you configure what you want to be sent and encode it
properly (attribute-resolver.xml) then you release the proper encoded
NameID to the RP (attribute-filter.xml). You do have to deny the release
of the other NameIDs that are generated to that RP or you will get first
come order for your release.

> AssertionConsumerServiceURL tag in the request, that is what I felt it is
> very different to the SAML 2 requests we get from other SPs, What are your
> comments on that?

Been a while since I took apart the request but your ACS endpoints
should look something like ...

HTTP-Artifact <server>/fed/sp/art20 
HTTP-POST <server>/fed/sp/authnResponse20
HTTP-POST-SimpleSign <server>/fed/sp/authnResponse20ss

> Even we fix this (nameId Format), I am under the impression there is also an
> certificate issue in SP side probably loading our IdP certificate which is a
> self signed certificate.

This is all via the lame GUI so yea you have to match your self-signed
cert with the proper endityId and such within OIF.


Also just a note (yes Scott I'll get around to the wiki one of these days)... 
If I recall correctly getting attributes to work is semi-tedious. I believe 
the inetOrgPerson stuff was semi legible on the OIF side but the rest had 
to be mapped into something legible.


------
thanks
  kevin.foote