ArcGIS on Shib 3

[McKean, Brandon Scott - mckeanbs]

Since you said you're new to Shibboleth, I think I should probably
explain some bits a bit better.
The p:attributeSourceIds="cn" is assuming ldap like configuration like
what we have. Your ldap configuration may very, but not by much I
imagine. Most of that configuration is done in attribute-resolver.xml,
which you can see what I did a few messages back.
Brandon McKean
On Wed, 2015-07-01 at 19:44 +0000, McKean, Brandon Scott - mckeanbs
wrote:
> Hi jmarsch,
> 
> Sorry for the confusion, as Scott points out, that isn't something
> you absolutely need to do there, I just did it for testing purposes.
> You can either alter the metadata, or have a specific stanza for
> them. 
> 
> Here's what I did in saml-nameid.xml:
> 
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"
>             p:attributeSourceIds="cn" />
> 
> The eid part is arbitrary, you just need to keep it consistent across
> the config.
> 
> Then, in relying-party.xml:
> 
> 
> c:relyingPartyIds="JMU.maps.arcgis.com">
>             <property name="profileConfigurations">
>                 <list>
>                     
> p:encryptAssertions="false"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid
> -format:eid"/>
> 	> 	> 
>             </property>
>         </bean>
> 
> 
> You can also set the nameid in the metadata for them, I just figured
> I'd do it in their relying party since it already has special
> requirements.
> 
> Hope this helps some, but let me know.
> 
> I also welcome improvements to that configuration.
> 
> Thanks,
> 
> Brandon
> 
> On Wed, 2015-07-01 at 11:50 -0700, jmarsch wrote:
> > > Lastly you need to make sure that nameid format is being used for
> > > arcgis. I'm currently doing it globally in relying-party.xml
> > > since it's
> > > a testbox,
> > 
> > 
> > Hi Brandon:
> > 
> > I'm following your thread -- I am trying to build a similar test
> > instance. 
> > I am extremely new to Shibboleth.  I'm following your config
> > snippets, and
> > sadly, I simply don't know how to perform the step that you have
> > quoted
> > above (make a nameid format used globally in rely-party.xml).
> > 
> > Can you post a snippet?
> > 
> > 
> > 
> > 
> > --
> > View this message in context: http://shibboleth.1660669.n2.nabble.c
> > om/ArcGIS-on-Shib-3-tp7616612p7616865.html
> > Sent from the Shibboleth - Users mailing list archive at
> > Nabble.com.
> -- 
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150701/5e48dd82/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150701/5e48dd82/attachment.bin>