SSO with multiple Google domains

Andrew Cheung acheung at brookfieldres.com
Mon Jan 19 10:21:26 EST 2015 

Hi. I need help in configuring Shibboleth for SSO to multiple Google
domains. Here is my scenario :

Shibboleth version used : 2.4.3

At Google,  the primary domain is: dev.mysiteA.ca

We also have a secondary domain : dev.mysiteB.com

We have 1 IDP set up on RHEL 6.5, on tomcat7. We also integration with
Novell eDirectory (this is our user store) using LDAP.

Before I did anything for the secondary domain, the configuration that I
have set up for the primary domain works and I can SSO to the primary
domain works fine (I go to http://mail.google.com/a/dev.mysiteA.ca, put in
my credentials and can log into my email account at dev.mysiteA.ca).

Howerver, when I tried adding in the configuration for the secondary domain
(see below for the configurations), and then go to “
http://mail.google.com/a/dev.mysiteB.com, I got the error “Invalid Email”.

I used SAML tracer in firefox to examine the SAML requests, and observed
that the first SAML request has

AssertionConsumerServiceURL="https://www.google.com/a/dev.mysiteA.ca/acs"

although I am trying to access http://mail.google.com/dev.mysiteB.com

The SAML response has

<saml2p:Response Destination="https://www.google.com/a/dev.mysiteA.ca/acs"

instead of the secondary domain (dev.mysiteB.com) as well.

My question is : How should I configure the secondary domain so that users
in either the primary domain or the secondary domain can SSO to their
respective domains properly?

Any help is appreciated.

 -Andrew

---------------------------------------------------------

The configuration I used that yields the above behaviour is as follows:

attribute-filter.xml :

<!-- Google dev.mysiteA.ca -->

<afp:AttributeFilterPolicy id="releaseTransientIdToAnyoneGoogleA">

 <afp:PolicyRequirementRule xsi:type="basic:NOT">

   <basic:Rule xsi:type="basic:AttributeRequesterString" value="
mail.google.com/a/dev.mysiteA.ca" />

 </afp:PolicyRequirementRule>

  <afp:AttributeRule attributeID="transientId">

   <afp:PermitValueRule xsi:type="basic:ANY" />

 </afp:AttributeRule>

</afp:AttributeFilterPolicy>

<!-- Google dev.mysiteB.com-->



<afp:AttributeFilterPolicy id="releaseTransientIdToAnyoneGoogleB">

 <afp:PolicyRequirementRule xsi:type="basic:NOT">

   <basic:Rule xsi:type="basic:AttributeRequesterString" value="
mail.google.com/a/dev.mysiteB.com" />

 </afp:PolicyRequirementRule>

 <afp:AttributeRule attributeID="transientId">

   <afp:PermitValueRule xsi:type="basic:ANY" />

 </afp:AttributeRule>

</afp:AttributeFilterPolicy>

  <!-- Google  -->



<afp:AttributeFilterPolicy id="releaseGoogleNameID">

 <afp:PolicyRequirementRule xsi:type="basic:NOT">

    <basic:Rule xsi:type="basic:AttributeRequesterString" value="google.com
"/>

 </afp:PolicyRequirementRule>

 <afp:AttributeRule attributeID="GoogleNameID">

   <afp:PermitValueRule xsi:type="basic:ANY" />

 </afp:AttributeRule>

</afp:AttributeFilterPolicy>

-----------------------------

attribute-resolver.xml :

<!-- Google  -->

<resolver:AttributeDefinition id="GoogleNameID" xsi:type="ad:Simple"
 sourceAttributeID="cn">

 <resolver:Dependency ref="myLDAP" />

 <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>

 <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>

</resolver:AttributeDefinition>

….

 <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"

       ldapURL="ldap://1.2.3.4:389"

       baseDN="ou=users,o=myCompany"

       principal="cn=loginuser,ou=users,o=myCompany"

       principalCredential="mypassword">

       <dc:FilterTemplate>

           <![CDATA[

               (cn=$requestContext.principalName)

           ]]>

       </dc:FilterTemplate>

---------------------------------------

handler.xml :

<ph:LoginHandler xsi:type="ph:UsernamePassword"


jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config">

       <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>

   </ph:LoginHandler>



--------------------------------

relying-party.xml :

<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
includeAttributeStatement="true"

                                assertionLifetime="PT5M"
assertionProxyCount="0"

                                signResponses="always"
signAssertions="always"

                                encryptAssertions="never"
encryptNameIds="never"

                                includeConditionsNotBefore="true"/>


<!-- Google -->

   <rp:RelyingParty id="google.com"

       provider="https://idp.mycompany.com/idp/shibboleth"

       defaultSigningCredentialRef="IdPCredential">

   <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />

</rp:RelyingParty>


<!-- Load the IdP's own metadata.  This is necessary for artifact support.
-->

       <metadata:MetadataProvider id="IdPMD"
xsi:type="metadata:FilesystemMetadataProvider"


metadataFile="/opt/shibboleth-idp/metadata/idp-metadata.xml"

                                  maxRefreshDelay="P1D" />

     <metadata:MetadataProvider xsi:type="FilesystemMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata" id="GoogleMD"
metadataFile="/opt/shibboleth-idp/metadata/googledev-metadata.xml" />



 <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">

       <security:PrivateKey>/opt/shibboleth-idp/credentials/idp.key</security:PrivateKey>

       <security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate>

   </security:Credential>

-----------------

googledev-metadata.xml:

<EntityDescriptor entityID="google.com"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">

   <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

       <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>

       <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

           Location="https://www.google.com/a/dev.mysiteA.ca/acs" />

       <AssertionConsumerService index="2"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

           Location="https://www.google.com/a/dev.mysiteB.com/acs" />

   </SPSSODescriptor>

</EntityDescriptor>




-- 

*Andrew Cheung*

Senior Developer



*Royal LePage Real Estate Services / Brookfield Real Estate Services*

39 Wynford Drive, Toronto, ON M3C 3K5

*T* 416.510.5734  *V* 415734

Email: acheung at b <X at royallepage.ca>rookfieldres.com

www.royallepage.ca

Download our iPhone App
<https://itunes.apple.com/ca/app/royal-lepage-canada/id810365559?mt=8>


*Join Royal LePage on:*

Facebook <https://www.facebook.com/royallepage>  |  LinkedIn
<http://www.linkedin.com/company/royal-lepage>  |  Twitter
<https://twitter.com/royal_Lepage>  |  Google+
<https://plus.google.com/u/0/+royallepage/posts>  |  Pinterest
<http://www.pinterest.com/rlpcanada/>  |  YouTube
<https://www.youtube.com/user/RoyalLePageCanada> |  Instagram
<http://www.instagram.com/royal_lepage>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150119/db74e31f/attachment-0001.html

More information about the users mailing list