SSO with multiple Google domains

Tue Jan 20 12:50:29 EST 2015

Is this actually two separate domains in Google? Or one domain (dev.mysiteA.ca<http://dev.mysiteA.ca>) in Google with a subdomain (dev.mysiteB.com<http://dev.mysiteB.com>) in it? If it's actually only one domain, then this is working correctly as designed.

________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Andrew Cheung <acheung at brookfieldres.com>
Sent: Monday, January 19, 2015 9:21 AM
To: users at shibboleth.net
Subject: SSO with multiple Google domains

Hi. I need help in configuring Shibboleth for SSO to multiple Google domains. Here is my scenario :

Shibboleth version used : 2.4.3

At Google,  the primary domain is: dev.mysiteA.ca<http://dev.mysiteA.ca>

We also have a secondary domain : dev.mysiteB.com<http://dev.mysiteB.com>

We have 1 IDP set up on RHEL 6.5, on tomcat7. We also integration with Novell eDirectory (this is our user store) using LDAP.

Before I did anything for the secondary domain, the configuration that I have set up for the primary domain works and I can SSO to the primary domain works fine (I go to http://mail.google.com/a/dev.mysiteA.ca, put in my credentials and can log into my email account at dev.mysiteA.ca<http://dev.mysiteA.ca>).

Howerver, when I tried adding in the configuration for the secondary domain (see below for the configurations), and then go to “http://mail.google.com/a/dev.mysiteB.com, I got the error “Invalid Email”.

I used SAML tracer in firefox to examine the SAML requests, and observed that the first SAML request has

AssertionConsumerServiceURL="https://www.google.com/a/dev.mysiteA.ca/acs"

although I am trying to access http://mail.google.com/dev.mysiteB.com

The SAML response has

<saml2p:Response Destination="https://www.google.com/a/dev.mysiteA.ca/acs"

instead of the secondary domain (dev.mysiteB.com<http://dev.mysiteB.com>) as well.

My question is : How should I configure the secondary domain so that users in either the primary domain or the secondary domain can SSO to their respective domains properly?

Any help is appreciated.

 -Andrew

---------------------------------------------------------

The configuration I used that yields the above behaviour is as follows:

attribute-filter.xml :

<!-- Google dev.mysiteA.ca<http://dev.mysiteA.ca> -->

<afp:AttributeFilterPolicy id="releaseTransientIdToAnyoneGoogleA">

 <afp:PolicyRequirementRule xsi:type="basic:NOT">

   <basic:Rule xsi:type="basic:AttributeRequesterString" value="mail.google.com/a/dev.mysiteA.ca<http://mail.google.com/a/dev.mysiteA.ca>" />

 </afp:PolicyRequirementRule>

  <afp:AttributeRule attributeID="transientId">

   <afp:PermitValueRule xsi:type="basic:ANY" />

 </afp:AttributeRule>

</afp:AttributeFilterPolicy>

<!-- Google dev.mysiteB.com-->

<afp:AttributeFilterPolicy id="releaseTransientIdToAnyoneGoogleB">

 <afp:PolicyRequirementRule xsi:type="basic:NOT">

   <basic:Rule xsi:type="basic:AttributeRequesterString" value="mail.google.com/a/dev.mysiteB.com<http://mail.google.com/a/dev.mysiteB.com>" />

 </afp:PolicyRequirementRule>

 <afp:AttributeRule attributeID="transientId">

   <afp:PermitValueRule xsi:type="basic:ANY" />

 </afp:AttributeRule>

</afp:AttributeFilterPolicy>

  <!-- Google  -->

<afp:AttributeFilterPolicy id="releaseGoogleNameID">

 <afp:PolicyRequirementRule xsi:type="basic:NOT">

    <basic:Rule xsi:type="basic:AttributeRequesterString" value="google.com<http://google.com>"/>

 </afp:PolicyRequirementRule>

 <afp:AttributeRule attributeID="GoogleNameID">

   <afp:PermitValueRule xsi:type="basic:ANY" />

 </afp:AttributeRule>

</afp:AttributeFilterPolicy>

-----------------------------

attribute-resolver.xml :

<!-- Google  -->

<resolver:AttributeDefinition id="GoogleNameID" xsi:type="ad:Simple"  sourceAttributeID="cn">

 <resolver:Dependency ref="myLDAP" />

 <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>

 <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>

</resolver:AttributeDefinition>

….

 <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"

       ldapURL="ldap://1.2.3.4:389<http://1.2.3.4:389>"

       baseDN="ou=users,o=myCompany"

       principal="cn=loginuser,ou=users,o=myCompany"

       principalCredential="mypassword">

       <dc:FilterTemplate>

           <![CDATA[

               (cn=$requestContext.principalName)

           ]]>

       </dc:FilterTemplate>

---------------------------------------

handler.xml :

<ph:LoginHandler xsi:type="ph:UsernamePassword"

                 jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config">

       <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>

   </ph:LoginHandler>

--------------------------------

relying-party.xml :

<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true"

                                assertionLifetime="PT5M" assertionProxyCount="0"

                                signResponses="always" signAssertions="always"

                                encryptAssertions="never" encryptNameIds="never"

                                includeConditionsNotBefore="true"/>

<!-- Google -->

   <rp:RelyingParty id="google.com<http://google.com>"

       provider="https://idp.mycompany.com/idp/shibboleth"

       defaultSigningCredentialRef="IdPCredential">

   <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />

</rp:RelyingParty>

       <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider"

                                  metadataFile="/opt/shibboleth-idp/metadata/idp-metadata.xml"

                                  maxRefreshDelay="P1D" />

     <metadata:MetadataProvider xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata" id="GoogleMD" metadataFile="/opt/shibboleth-idp/metadata/googledev-metadata.xml" />

 <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">

       <security:PrivateKey>/opt/shibboleth-idp/credentials/idp.key</security:PrivateKey>

       <security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate>

   </security:Credential>

-----------------

googledev-metadata.xml:

<EntityDescriptor entityID="google.com<http://google.com>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">

   <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

       <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>

       <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

           Location="https://www.google.com/a/dev.mysiteA.ca/acs" />

       <AssertionConsumerService index="2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

           Location="https://www.google.com/a/dev.mysiteB.com/acs" />

   </SPSSODescriptor>

</EntityDescriptor>

--

Andrew Cheung

Senior Developer

Royal LePage Real Estate Services / Brookfield Real Estate Services

39 Wynford Drive, Toronto, ON M3C 3K5

T 416.510.5734  V 415734

Email: acheung at b<mailto:X at royallepage.ca>rookfieldres.com<http://rookfieldres.com>

www.royallepage.ca<http://www.royallepage.ca/>

Download our iPhone App<https://itunes.apple.com/ca/app/royal-lepage-canada/id810365559?mt=8>

Join Royal LePage on:

Facebook<https://www.facebook.com/royallepage>  |  LinkedIn<http://www.linkedin.com/company/royal-lepage>  |  Twitter<https://twitter.com/royal_Lepage>  |  Google+<https://plus.google.com/u/0/+royallepage/posts>  |  Pinterest<http://www.pinterest.com/rlpcanada/>  |  YouTube<https://www.youtube.com/user/RoyalLePageCanada> |  Instagram<http://www.instagram.com/royal_lepage>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150120/24313da1/attachment-0001.html 