Having trouble with my configuration
Josh Christensen
jchristensen at ftni.com
Fri Mar 14 15:53:55 EDT 2014
I am struggling to get the shibboleth service provider working on my Windows Server 2008 x64 box running IIS 7.5.
I have the service running. It stops at starts without issue. We have IDP-initiated working in that the user signs in at the IDP (an external server not running shibboleth), and the user is sent to our test page where we write out information about the request in an effort to figure out where the data is stored for retrieval and authentication on our site.
The logs have no errors.
In shibboleth2.xml, my configuration to the meta data is as follows:
<MetadataProvider type="XML" path="ING_SAML_Metadata_external.xml" reloadInterval="7200">
</MetadataProvider>
That XML file looks like this and was provided by the client with the IDP:
<EntityDescriptor entityID="http://saml.company.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">
<IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="false">
<KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>
<!-removed for security reasons -->
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<!-- Supported Name Identifier Formats -->
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
<!-- AuthenticationRequest Consumer endpoint -->
<SingleSignOnService isDefault="true" index="0" Location="https://www2.accp.company.com/esamloutbound/saml?target=MySite" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
</IDPSSODescriptor>
</EntityDescriptor>
Originally, there was an EntityConfig section following the EntityDescriptor closing tag, but that cause the service to error on startup, so I commented it out. Here is what it looks like.
<EntityConfig xmlns="urn:sun:fm:SAML:2.0:entityconfig"
xmlns:fm="urn:sun:fm:SAML:2.0:entityconfig"
hosted="1"
entityID="http://saml.company.com">
<IDPSSOConfig metaAlias="/users/idp">
<Attribute name="email">
<Value></Value>
</Attribute>
</IDPSSOConfig>
</EntityConfig>
I am at a loss with what to do with this. The documentation is not clear on this section or what to do with it.
In my attribute-map.xml, I have tried several different ways of mapping the attributes and none are being picked up.
<!-- Fourth, the SAML 2.0 NameID Format: -->
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
</Attribute>
<!-- Comapny email attribute -->
<Attribute name="urn:sun:fm:SAML:2.0:entityconfig:email" id="email" />
<Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" id="userid">
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
</Attribute>
<Attribute name="urn:oasis:names:tc:SAML:2.0:assertion:ID" id="company-id" />
<Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" id="company-nameid" />
<Attribute name="http://www.w3.org/2001/XMLSchema/email" id="company-email" />
And finally, a sample of the XML sent from the IDP.
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="http://test.mysite.com:25000/home/test" ID="R_d94a80ea-cf0a-4caa-9e6d-211e566c9163" IssueInstant="2014-03-14T13:47:43.139Z" Version="2.0">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://saml.company.com</saml:Issuer<http://saml.company.com%3c/saml:Issuer>>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#R_d94a80ea-cf0a-4caa-9e6d-211e566c9163">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="ds saml samlp xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue> <!-- Omitted --> </ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue> <!-- Omitted --> </ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate> <!-- Omitted --> </ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</samlp:Status>
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="A_84f4f5a1-e3e3-4090-a24f-842cc24a5c49" IssueInstant="2014-03-14T13:47:43.039Z" Version="2.0">
<saml:Issuer>http://saml.company.com</saml:Issuer<http://saml.company.com%3c/saml:Issuer>>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">a86457332</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2014-03-14T13:49:43.129Z" Recipient="http://test.mysite.com:25000/home/test"/>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2014-03-14T13:42:43.139Z" NotOnOrAfter="2014-03-14T13:49:43.129Z">
<saml:AudienceRestriction>
<saml:Audience>http://mysite.com</saml:Audience<http://mysite.com%3c/saml:Audience>>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2014-03-14T13:47:43.139Z">
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
<saml:AttributeStatement>
<saml:Attribute FriendlyName="email" Name="email">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">user at mydomain.com</saml:AttributeValue<mailto:user at mydomain.com%3c/saml:AttributeValue>>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>
Any thoughts out there on what I am doing wrong?
Josh Christensen, Mobile and Web Platform Architect
FTNI - One Solution, Many Possibilities
13220 Birch Drive, Suite 120, Omaha, NE 68164
Phone 402-502-8777, ext. 110 | Fax 402-502-8788
jchristensen at FTNI.com<mailto:jchristensen at FTNI.com> | www.FTNI.com<http://www.ftni.com/>
[cid:451b20e8-10b2-4cb7-a9b4-cf5708bb40d0 at exchange.electric.net]
This message and any attachments are confidential, may contain privileged information, and are intended solely for the recipient named above. If you are not the intended recipient, or a person responsible for delivery to the named recipient, you are notified that any review, distribution, dissemination or copying is prohibited. If you have received this message in error, you should notify the sender by return email and delete the message from your computer system.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140314/88c2b736/attachment-0001.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 12435 bytes
Desc: image001.png
Url : http://shibboleth.net/pipermail/users/attachments/20140314/88c2b736/attachment-0001.png
More information about the users
mailing list