Multiple SP's from the Same Entity ID

[Drew M. Zebrowski]

Hi,

We are integrating 5 WebEx sites with our IDP. They all have individual metadata and for each metadata, the entity ID is the same (https://www.webex.com). I've never done a setup like this before and want some advice on whether or not I'm doing this correctly.

I created a metadata file for each site and added the following configuration to relying-party.xml:

<!-- webex -->
<RelyingParty id="https://www.webex.com"
             provider="https://fim.temple.edu/idp/shibboleth"
             defaultSigningCredentialRef="IdPCredential">
   <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
</RelyingParty>


<!-- Webex -->
<MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
                  id="webexfox" metadataFile="/opt/shibboleth-idp/metadata/webex_foxsbm_metadata.xml" />

<MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
                  id="webextu" metadataFile="/opt/shibboleth-idp/metadata/webex_templeuniversity_metadata.xml" />

<MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
                  id="webexed" metadataFile="/opt/shibboleth-idp/metadata/webex_tueducation_metadata.xml" />

<MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
                  id="webexlaw" metadataFile="/opt/shibboleth-idp/metadata/webex_tulaw_metadata.xml" />

<MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
                  id="webexstudents" metadataFile="/opt/shibboleth-idp/metadata/webex_tustudents_metadata.xml" />


Then I added the appropriate config to attribute-filters.xml:

<!-- Webex -->
<afp:AttributeFilterPolicy id="releaseForWebex" >

        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://www.webex.com" />

        <afp:AttributeRule attributeID="webexNameId">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="uid">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="email">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="lastname">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="firstname">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

</afp:AttributeFilterPolicy>


Has anyone ever done a similar integration or know if this is correct. If not, what can I do to make this setup work?

Thanks,

Drew Z.

____________________________

Drew Zebrowski
Lead Identity Management Software Developer
Office of Identity and Access Management

To request help from Computer Services, please visit: https://tuhelp.temple.edu<https://tuhelp.temple.edu/>

P Think before you print


CONFIDENTIALITY STATEMENT: The information contained in this e-mail, including attachments, is the confidential information of, and/or is the property of, Temple University. The information is intended for use solely by the individual or entity named in the e-mail. If you are not an intended recipient or you received this in error, then any review, printing, copying, or distribution of any such information is prohibited. Please notify the sender immediately by reply e-mail and then delete this e-mail from your system.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141202/87aea3a2/attachment-0001.html