users Digest, Vol 23, Issue 38
psadminindra at gmail.com
psadminindra at gmail.com
Thu May 16 05:18:28 EDT 2013
----------
Sent via Nokia Email
------Original message------
From: <users-request at shibboleth.net>
To: <users at shibboleth.net>
Date: Wednesday, May 15, 2013 4:56:18 PM GMT-0400
Subject: users Digest, Vol 23, Issue 38
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. Multiple Source Attributes for Mapped Attribute (Ken Hammer)
2. Re: REMOTE_USER (JF)
3. RE: How do you setup multiple IDPs to answer requests
(Kevin P. Foote)
4. RE: IdP unable to parse SP authN request (Cantor, Scott)
5. RE: Multiple Source Attributes for Mapped Attribute
(Cantor, Scott)
----------------------------------------------------------------------
Message: 1
Date: Wed, 15 May 2013 16:05:58 -0400
From: Ken Hammer <khammer at umich.edu>
Subject: Multiple Source Attributes for Mapped Attribute
To: shib users <users at shibboleth.net>
Message-ID: <5193EAA6.2090809 at umich.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Hi,
I was wondering if would be possible to use 2 different source attributes
in the same Value Map.
I need to provide an entitlement to a vendor based on our users having
a particular
value in one attribute or return a different value based on another
attribute. So the
map sketches out to be something like this:
sourceAttributeID=JobTitle
<ValueMap>
<ReturnValue>HasJob</ReturnValue>
<SourceValue>Title=Professor</SourceValue>
</ValueMap>
sourceAttributeID=Location
<ValueMap>
<ReturnValue>OnThisPlanet</ReturnValue>
<SourceValue>City=NewYork</ReturnValue>
</ValueMap>
The problem is the vendor wants only one of the 2 values, and no other
in the eduPersonEntitlement
attribute. Could I do this with multiple resolver:Dependency(s)? That
would seem to me
to "break" the mapping.
Any help would be appreciated.
--
Ken Hammer
ITS Identity and Access Management
University Of Michigan
Opera is when a guy gets stabbed in the back and
instead of bleeding he sings. - Edward Gardner
------------------------------
Message: 2
Date: Wed, 15 May 2013 21:28:05 +0100
From: JF <jamesforrest56 at gmail.com>
Subject: Re: REMOTE_USER
To: Shib Users <users at shibboleth.net>
Message-ID: <763A575E-11B5-465D-903D-6643F566CB72 at gmail.com>
Content-Type: text/plain; charset="windows-1252"
Scott
Thankyou for the replies and bearing with these questions?.
If I translate your answer into config would you be so kind as to confirm (or correct!) my understanding:
1) Well, you need to define an attribute definition that establishes the
value in some way based on the requestContext.principalName data. There is
no such thing as "username" in SAML, you have to encode it into some
Attribute, such as eduPersonPrincipalName, or as a SAML NameID in some
custom format.
This I do in the IdP in attribute-resolver.xml and use eduPersonPrincipalName. The config at the moment shows:
<resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonPrincipalName" scope="scopehere.com" sourceAttributeID="uid">
<resolver:Dependency ref="myLDAP" />
<resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" />
<resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" />
</resolver:AttributeDefinition>
Is there a way I can set this to the value the user typed into the username field (which I believe SAML calls principal?) without having to of to an external LDAP/DB to retrieve?
2) Then you need to release the relevant attribute ID within the IdP to the
SP.
This I do in attribute-filter.xml I believe: ( I know this will release to all SPs but this will do for now)
<!-- Release the transient ID to anyone -->
<afp:AttributeFilterPolicy id="releaseeduPersonPrincipalNameToAnyone">
<afp:PolicyRequirementRule xsi:type="basic:ANY"/>
<afp:AttributeRule attributeID="eduPersonPrincipalName">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
The on the IDP I have to do nothing as it will map eduPersonPrincipalName to REMOTE_USER?
Does that look right?
JF
On 15 May 2013, at 19:59, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> And I should have noted, if you just use eduPersonPrincipalName, then
> there's nothing to do on the SP side, that's all done by default.
>
> But nothing can define EPPN for you, you have to generate it as
> appropriate, be it directly from the username and adding the scope, or
> pulling it from LDAP, or whatnot.
>
> -- Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130515/babbc69e/attachment-0001.html
------------------------------
Message: 3
Date: Wed, 15 May 2013 16:33:19 -0400 (EDT)
From: "Kevin P. Foote" <kpfoote at iup.edu>
Subject: RE: How do you setup multiple IDPs to answer requests
To: Shib Users <users at shibboleth.net>
Message-ID: <alpine.LFD.2.03.1305151622540.11443 at iup.edu>
Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII
On Wed, 15 May 2013, Leonard Kroll wrote:
> What version of TerraCotta works with Shibboleth?
> The DOC says version 3.2.1, but it is not available from TerraCotta.
> Will the latest version of TerraCotta work? Does anybody have it working?
Latest TC does not directly support the tomcat-tim DSO integration
approach, which is what shibboleth makes use of.. (It's basically
untested but on my waytoolong todo list)
The 3.5.x series of Terracotta is the latest known working across shib
deployments... At least that any one cares to speak up about.
I know it will work on 3.5.4 but I only have 3.5.2 on hand currently..
http://www.people.iup.edu/kpfoote/files/terracotta-3.5.2.tar.gz
------
thanks
kevin.foote
------------------------------
Message: 4
Date: Wed, 15 May 2013 20:54:05 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: IdP unable to parse SP authN request
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D9491383750FD77B at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> Caused by: java.util.zip.ZipException: oversubscribed dynamic bit lengths
> tree
Never seen it but I would imagine either they're using the redirect endpoint to send a POST binding request, or they've botched the Redirect binding DEFLATE process, as those are the two most common problems.
> Vendor-provided example of the authN request:
That's not a binding-encoded example that means anything in the context of this error, but more to the point it's got an XML signature inside it, which is invalid for a Redirect binding message.
-- Scott
------------------------------
Message: 5
Date: Wed, 15 May 2013 20:55:42 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Multiple Source Attributes for Mapped Attribute
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D9491383750FD78D at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
I think the template attribute defintion is probably a better fit, but:
> The problem is the vendor wants only one of the 2 values, and no other
> in the eduPersonEntitlement attribute.
The vendor is imposing an invalid requirement (ePE is multi-valued) but that notwithstanding, the right place for this is probably your filter rule, not the resolver.
-- Scott
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 23, Issue 38
*************************************
More information about the users
mailing list