How to specify different login handlers

[Andrew Cheung]

Hi. We're using Shibboleth 2.4.3 as IDP and integrate it with the dotCMS
system. dotCMS is the platform of our intranet and it needs to use the
RemoteUser login handler).

We also integrate with Salesforce as SP. With our current configurations,
we have 2 user scenarios:

Scenario 1 : If a user logs into dotCMS  and then clicks on a link to
Salesforce that  is on a page on dotCMS, it does a single-sign-on correctly
and the user lands on the home page at Salesforce after logging in.

Scenario 2: If a user puts the same salesforce link in a new browser, the
user just goes straight through to the "login error" page at Salesforce
instead of being directed to the login page of dotCMS. Upon looking at the
shibboleth logs, it says that no user identiified by login handler. From
the SAML tracer in firefox, I can see a SAML request and then followed by a
SAML response without getting the login page of the dotCMS.

I can somehow understand why this behavior occurs (it's because the
Salesforce configuration is using RemoteUser login handler as well, which
is expecting the same stuff we send in the dotCMS case). Since Salesforce
is not sending the same user information to the IDP, it just falls through
with no user info and hence login error.

My question is : What should I do to, I presume, the Salesforce
configuration, so that  scenario 2 will work as follows: User puts in the
salesforce url in a new browser, gets directed to the login page of dotCMS.
Upon entering the user's credentials, the user logs in to Salesforce and
lands onto the home page at Salesforce.

My current configuration for Salesforce in the relying-party.xml is as
follows:

*<rp:RelyingParty id="https://saml.salesforce.com
<https://saml.salesforce.com>"
provider="https://idp.myintranet.com/idp/shibboleth
<https://idp.myintranet.com/idp/shibboleth>"
defaultSigningCredentialRef="IdPCredential">*
*  <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never"/>*
*</rp:RelyingParty>*

I have also tried the following:
*<rp:RelyingParty id="https://saml.salesforce.com
<https://saml.salesforce.com>"
provider="https://idp.rlpnetwork.com/idp/shibboleth
<https://idp.rlpnetwork.com/idp/shibboleth>"
defaultSigningCredentialRef="IdPCredential"
defaultAuthenticationMethod="ph:UsernamePassword">*
*  <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never"/>*
*</rp:RelyingParty>*

and

*<rp:RelyingParty id="https://saml.salesforce.com
<https://saml.salesforce.com>"
provider="https://idp.rlpnetwork.com/idp/shibboleth
<https://idp.rlpnetwork.com/idp/shibboleth>"
defaultSigningCredentialRef="IdPCredential"
defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">*
*  <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never"/>*
*</rp:RelyingParty>*

Unfortunately, neither worked.


Note: Before we integrate with dotCMS, I use the UsernamePassword
loginHandler and Salesforce SSO was working at that time.

Any help is appreciated.

  -Andrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150212/525e4dca/attachment.html