SSO with multiple Google domains

[Andrew Cheung]

Hi Scott. What should the format for the first encoder be then if this is
used for email addresses?

I will clean up the attributes to just use one.

  -Andrew

On Tue, Jan 20, 2015 at 1:37 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/20/15, 6:22 PM, "Andrew Cheung" <acheung at brookfieldres.com> wrote:
>
>
>
> >Hi, David. This is actually 1 domain in google (primary domain is :
> >dev.mySiteA.ca <http://dev.mysitea.ca/>)
> > with a subdomain dev.mySiteB.com <http://dev.mysiteb.com/>.
> >
> >By the way I got it working. Here are the relevant pieces for those who
> >are interested:
>
> You don't need to block transients like that, you just need to specify the
> NameID format you want in the SP metadata for Google.
>
> ><resolver:AttributeDefinition xsi:type="Simple"
> >xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="GoogleMySiteAEmail"
> >sourceAttributeID="mail">
> > <resolver:Dependency ref="myLDAP" />
> >   <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
> >nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
> >  <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> >nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
> ></resolver:AttributeDefinition>
>
> That first encoder is just plain wrong, that format is for transients in
> SAML 1.1.
>
> And I don't really follow why you'd create two separate attributes for the
> domains if the value is the same.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150120/50aa87d3/attachment.html