Blackboard Transact, SSO and use of attribute friendly-name

[Joel Goguen]

We have integrated Shib with Transact. Not all of the OIDs in their documentation were accurate when we set it up though. It took a bit of back-and-forth to get the right OIDs, and nothing worked until both OIDs and friendly names were correct.

Here's what we ended up setting up for them. Some of our attributes are custom, I've put those in parens with a brief description instead of the name itself.

<resolver:AttributeDefinition xsi:type="ad:Simple" id="bbEmail" sourceAttributeID="mail">
	<resolver:Dependency ref="myLDAP" />
	<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="BbSPEmailAddress" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="bbGivenName" sourceAttributeID="givenName">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="BbSPFirstName" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="bbLastName" sourceAttributeID="sn">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="BbSPLastName" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="bbUserName" sourceAttributeID="uid">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="BbSPUserName" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="bbCustomerNumber" sourceAttributeID="(a unique 'customer number')">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.18532.1.3.4" friendlyName="BbSPCustomerNumber" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="bbCustomerCardNumber" sourceAttributeID="(the person's barcode)">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.18532.1.3.14" friendlyName="BbSPCustomerCardNumber" />
</resolver:AttributeDefinition>

Then of course we had to set up attribute-filter.xml to pass these along to them. We ended up with a PolicyRequirementRule like this, along with the AttributeRule entries for each AttributeDefinition:

<afp:PolicyRequirementRule xsi:type="basic:OR">
	<basic:Rule xsi:type="basic:AttributeRequesterString" value="(your base 'sp.transactsp.com' URI)/eaccounts" xmlns="urn:mace:shibboleth:2.0:afp:mf:basic" />
	<basic:Rule xsi:type="basic:AttributeRequesterString" value="(your base 'sp.transactsp.com' URI)/mgmt" xmlns="urn:mace:shibboleth:2.0:afp:mf:basic" />
</afp:PolicyRequirementRule>

-- 
Joel Goguen
Developer
Enterprise Solutions
Information Technology Services
University of New Brunswick
Email: joel.goguen at unb.ca
Phone: (506) 453-4872
Fax: (506) 453-3590


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Schwoerer, Bradley J
Sent: 13 March 2014 13:50
To: Users Shib
Subject: Blackboard Transact, SSO and use of attribute friendly-name

I was wondering how many people have integrated with Blackboard Transact.  It seems straight forward, but a bit odd if I am understanding their documentation.   According to their documentation they are making use of the SAML2 attribute friendly-name.  For people that have implemented this product, is that truly the case.  For others, is that something that other apps are doing?  To me it seems wrong, but wanted to get others perspective.  Here is an excerpt of their documentation:


Blackboard Transact SP requires that the attributes required for mapping into the Blackboard Transact system be the following where the attribute friendly name cannot be changed as this is what Blackboard Transact SP uses to map the data returned:

Depending on your institution's information policies you may need to adjust the information in the attribute- filter.xml file to release the attributes to the Transact SP Service.

<resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail">

<resolver:Dependency ref="myLDAP" />

<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" />

<resolver:AttributeEncoder xsi:type="enc:SAML2String"name="urn:oid:0.9.2342.19200300.100.1.3" friendly- Name="BbSPEmailAddress" />

</resolver:AttributeDefinition>



Bradley Schwoerer
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net