Shibboleth IdP v3 beta 1 Salesforce.com Integration

[Gary Gwin]

Hi Scott,

 > I believe SalesForce supports pulling the username from a SAML
 > Attribute. That is the better choice in general. Shibboleth does not
 > want you to use NameIDs and it is never the easiest route.

They suggest they do so I had tried that alternative before posting and 
couldn't get it to work. I found posts that suggest including the 
username in the Subject might be required by Salesforce:

https://success.salesforce.com/answers?id=90630000000gpzrAAA

I appreciate the best practice advise.

Gary

On 12/5/2014 1:08 PM, Cantor, Scott wrote:
> On 12/5/14, 7:34 PM, "Gary Gwin" <ggwin at cafesoft.com> wrote:
>>
>> How do I include the canonical username the SAML response Subject?
>
> It's not really documented yet, like most things, and what is there isn't
> updated since alpha2 or so. [1]
>
> You can do it the old way by encoding an attribute in the resolver, which
> is documented in the old docs, or you can do it the new way. Either way
> requires defining an AttributeDefinition in the resolver to expose
> whatever the value needs to be.
>
> The old way, you attach a special AttributeEncoder to that
> AttributeDefinition. The new way, you uncomment the bean in
> saml-nameid.xml called shibboleth.SAML2AttributeSourcedGenerator, set the
> format appropriately to whatever it needs to be, and tell it what
> attribute(s) to pull the value from.
>
> You still have to trigger that either with a NameIDFormat in the metadata,
> or a setting in relying-party.xml for a specific RP definition.
>
> I believe SalesForce supports pulling the username from a SAML Attribute.
> That is the better choice in general. Shibboleth does not want you to use
> NameIDs and it is never the easiest route.
>
> -- Scott
>
> [1]
> https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfig
> uration
>

-- 

Gary Gwin
Cafesoft
858.268.5100 x501
http://www.cafesoft.com

*****************************************************************
*                                                               *
*  Cams is a web single sign-on software solution for Apache,   *
*  IIS, WebLogic, WebSphere, JBoss and Tomcat web servers.      *
*                                                               *
*****************************************************************