SSO with multiple Google domains

[Cantor, Scott]

On 1/20/15, 6:22 PM, "Andrew Cheung" <acheung at brookfieldres.com> wrote:



>Hi, David. This is actually 1 domain in google (primary domain is : 
>dev.mySiteA.ca <http://dev.mysitea.ca/>)
> with a subdomain dev.mySiteB.com <http://dev.mysiteb.com/>.
>
>By the way I got it working. Here are the relevant pieces for those who 
>are interested:

You don't need to block transients like that, you just need to specify the 
NameID format you want in the SP metadata for Google.

><resolver:AttributeDefinition xsi:type="Simple" 
>xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="GoogleMySiteAEmail" 
>sourceAttributeID="mail">
> <resolver:Dependency ref="myLDAP" />
>   <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" 
>nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
>  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" 
>nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
></resolver:AttributeDefinition>

That first encoder is just plain wrong, that format is for transients in 
SAML 1.1.

And I don't really follow why you'd create two separate attributes for the 
domains if the value is the same.

-- Scott