Shibboleth IdP v3 beta 1 Salesforce.com Integration

[Gary Gwin]

Great information, thanks. I'm having difficulty understanding how to 
disable provider attribute encryption with IdP v3. My salesforce 
configuration is defined in metadata-providers.xml like this:

      <MetadataProvider
        id="salesforce"
        xsi:type="FilesystemMetadataProvider"
        metadataFile="%{idp.home}/metadata/salesforce.com-metadata.xml">
      </MetadataProvider>

The v3 docs point to credentials.xml/relying-party.xml, both of which 
are native Spring. I can't find where to do something like this 2.4:

     <rp:RelyingParty
       id="salesforce"
       provider="https://host.domain.org/idp/shibboleth"
       defaultSigningCredentialRef="IdPCredential">
       <rp:ProfileConfiguration
         xsi:type="saml:SAML2SSOProfile"
         encryptAssertions="never"
         encryptNameIds="never" />
     </rp:RelyingParty>

There's an example security.xml config file in the developer resources 
that looks like a good target, but I'm not sure that was implemented.

Thanks,

Gary

On 12/6/2014 6:54 AM, Peter Schober wrote:
> * Mark Boyce <Mark.Boyce at ucop.edu> [2014-12-06 01:13]:
>> We were successful using an attribute, but only without encryption.
>> Adding encryption forced us to revert to using a nameID / Subject
>> rather than attribute.  Salesforce supposedly supports both.  Seems
>> the choice is attribute without encryption or encryption and send
>> nameID/Subject.
>
> That proably means /unencrypted/ NameID in the Subject. So it needs to
> be unencrypted wherever you put it. The IDP tries to encrypt
> assertions by default, but not the NameID in the Subject.
> That explains why it "works" in the Subject, since it will be
> unencrypted there by default.
> -peter
>

-- 

Gary Gwin
http://www.cafesoft.com

*****************************************************************
*                                                               *
*  Cams is a web single sign-on software solution for Apache,   *
*  IIS, WebLogic, WebSphere, JBoss and Tomcat web servers.      *
*                                                               *
*****************************************************************