Does Shibboleth SP have any per-IDP config?

[Ken Weiss]

Dave & Scott,

Thanks for taking the time to respond. Scott, you're right, as Dave pointed out there are all sorts of things I could do in the SP to customize behavior on a per-IDP basis, but as you correctly inferred, I'm not doing anything anywhere near that fancy in my SP. I think I changed three or four lines from the shibboleth2.xml file that got installed when I built the package. :-)

I'll follow up with the IDPs.

--Ken
------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu<mailto:ken.weiss at ucop.edu>
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612


From: David Langenberg <davel at uchicago.edu<mailto:davel at uchicago.edu>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Thursday, February 6, 2014 2:31 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Does Shibboleth SP have any per-IDP config?

The answers are yes and no.  You could, with application overrides, make your SP behave differently for each IdP you integrate with.  However, I'm betting the problems here are at the IdP end especially if you're integrating via InCommon.  Unfortunately, you're going to have to slog it out with the IdP admins in this case.  Turning your logs up & capturing the decrypted assertions will assist with identifying where the problems lie and assist with tweaks you may want to make to your attribute-map to accommodate the other IdP's "specialness".  As for InCommon not releasing attributes, that's a new one.  Perhaps the IdP admin is expecting your SP to be tagged by InC as an R&S SP which would trigger a filter policy automatically & that's what they mean?

Dave


On Thu, Feb 6, 2014 at 3:14 PM, Ken Weiss <ken.weiss at ucop.edu<mailto:ken.weiss at ucop.edu>> wrote:
I'm pretty sure the answer is 'no', but I wanted to ask the broader group
just to be certain.

If my Shibboleth SP works with 3 different IDPs, but doesn't work with 3
others (failing in a different way for each of them), it's a pretty safe
bet that the configuration issues are with the IDP, not my SP, right?

I have one IDP that is returning two identical email addresses in the
'mail' attribute. That's causing our application to error out, which we
need to fix since email is a multi-valued attribute. But it's got nothing
to do with my SP.

I have one that isn't authorizing to my application correctly, which is
almost certainly a result of the IDP not releasing the right attributes.

And I have one that, for reasons that truly baffle me, reports that
"InCommon is not releasing the proper attributes." I have no idea what
InCommon would have to do with this - all they do is deliver the metadata
for my SP. Other than that, InCommon is not involved in the interaction,
since I'm no longer using InCommon's Discovery Service.

Anyway, before I tell them all to look at their own IDP configuration, I
thought it would be good to get a quick sanity check from some people that
have actually run an IDP at some point in their life (unlike me...).
Thanks!

--Ken
------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu<mailto:ken.weiss at ucop.edu>
UC Office of the President              510-587-6311<tel:510-587-6311> (office)
California Digital Library              916-905-6933<tel:916-905-6933> (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



--
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140207/a6cda8f1/attachment.html