SSO with multiple Google domains

[Andrew Cheung]

Hi, David. This is actually 1 domain in google (primary domain is :
dev.mySiteA.ca <http://dev.mysitea.ca/>) with a subdomain dev.mySiteB.com
<http://dev.mysiteb.com/>.

By the way I got it working. Here are the relevant pieces for those who are
interested:

attribute-filter.xml:

 <afp:AttributeFilterPolicy
id="doNotReleaseTransientIdToAnyoneGoogleMySiteA">
  <afp:PolicyRequirementRule xsi:type="basic:NOT">
    <basic:Rule xsi:type="basic:AttributeRequesterString" value="
mail.google.com/a/dev.mySiteA.ca" />
  </afp:PolicyRequirementRule>
   <afp:AttributeRule attributeID="transientId">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>


<afp:AttributeFilterPolicy id="releaseTransientIdToAnyoneGoogleMySiteB">
  <afp:PolicyRequirementRule xsi:type="basic:NOT">
    <basic:Rule xsi:type="basic:AttributeRequesterString" value="
mail.google.com/a/dev.mySiteB.com" />
  </afp:PolicyRequirementRule>
  <afp:AttributeRule attributeID="transientId">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>


 <afp:AttributeFilterPolicy id="releaseGoogleMySiteAEmail">
  <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="google.com/a/dev.mySiteA.ca"/>
  <afp:AttributeRule attributeID="GoogleMySiteAEmail">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>

 <afp:AttributeFilterPolicy id="releaseGoogleMySiteBEmail">
  <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="google.com/a/dev.mySiteB.com"/>
  <afp:AttributeRule attributeID="GoogleMySiteBEmail">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
</afp:AttributeFilterPolicy>


--------------------
attribute-resolver.xml :

<resolver:AttributeDefinition xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="GoogleMySiteAEmail"
sourceAttributeID="mail">
 <resolver:Dependency ref="myLDAP" />
   <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="GoogleMySiteBEmail"
sourceAttributeID="mail">
 <resolver:Dependency ref="myLDAP" />
   <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
</resolver:AttributeDefinition>

 <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://1.2.3.4:389"
        baseDN="ou=users,o=mycompany"
        principal="cn=loginuser,ou=users,o=myCompany"
        principalCredential="mypassword">
        <dc:FilterTemplate>
            <![CDATA[
                (cn=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
    <!--
    <ReturnAttributes>cn</ReturnAttributes>
    -->

    </resolver:DataConnector>


-----------------------
relying-party.xml :

 <rp:RelyingParty id="google.com/a/dev.mySiteA.ca"
        provider="https://idp.mycompany.com/idp/shibboleth"
        defaultSigningCredentialRef="IdPCredential">
    <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />
</rp:RelyingParty>

<rp:RelyingParty id="google.com/a/dev.mySiteB.com"
        provider="https://idp.mycompany.com/idp/shibboleth"
        defaultSigningCredentialRef="IdPCredential">
    <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never" />
</rp:RelyingParty>


  <metadata:MetadataProvider xsi:type="FilesystemMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata" id="GoogleMySiteAMD"
metadataFile="/opt/shibboleth-idp/metadata/googleMySiteAdev-metadata.xml" />

  <metadata:MetadataProvider xsi:type="FilesystemMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata" id="GoogleMySiteBMD"
metadataFile="/opt/shibboleth-idp/metadata/googleMySiteBdev-metadata.xml" />


------------

googleMySiteAdev-metadata.xml:


<EntityDescriptor entityID="google.com/a/dev.MySiteA.ca"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
        <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://www.google.com/a/dev.mySiteA.ca/acs" />
    </SPSSODescriptor>
</EntityDescriptor>

----------------------

googleMySiteBdev-metadata.xml:

<EntityDescriptor entityID="google.com/a/dev.mySiteB.com"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
        <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://www.google.com/a/dev.mySiteBl.com/acs" />
    </SPSSODescriptor>
</EntityDescriptor>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150120/f1e2022b/attachment.html