Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

[Peter Schober]

Charles: I'll give yet another shot. Read carefully.
If anything is still messed up in your mail client go to
shibboleth . net/pipermail/users/2015-June/ and read the pristine
copies of these posts there.

* Cantor, Scott <cantor.2 at osu.edu> [2015-06-01 22:33]:
> Charles.Cahill at ge.com:
> >I don't see the entityID coming into any of the available logs.
> 
> The value that it claims it has no metadata for is the entityID, and
> it's sitting right in the Issuer element if any request the IdP is
> handling, which Firefox can trace with extensions like SAMLTracer.

Right. @Charles: The entityID values for your SP is
  https :// ge-appliances.pagerduty.com
minus any spaces in that name, taken directly from an the
authentication request from pagerduty for your IDP.

I also have attached a complete, schema-valid and AFAICT correct
metadata document for that SAML SP, once as XML and again packed in a
ZIP file, maybe one of those makes it through. Otherwise get it from
the web archive, URL at the top.

Other than adding the included metadata snippet to a MetadataProvider
in your IDP and having that reload its metadata at some point, you
will still need the following to make this work -- but only AFTER the
"anonymous" error is gone:

(1) Suppress encrypted assertions to that SP, as David B. already wrote.
Based on what we know to be your SP this should look like this. Just
copy the correct provider="..." from the rp:DefaultRelyingParty
element in you relying-party.xml. All examples for IDPv2 below:

<rp:RelyingParty
    id="https :// ge-appliances.pagerduty.com" provider="YOUR-IDP-EntityID"
    defaultSigningCredentialRef="IdPCredential"
    defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
    nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
    <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" />
  </rp:RelyingParty>

Of course remove the spaces in the id XML-attribute, too.

(2) Configure your IDP to generate email addresses als SAML2 NameID.
Add the following to your attribute-resolver.xml. Assuming you have an
AttributeDefinition with the id "email" defined, this will take that
attribute and turn it into a NameID:

  <!-- https :// wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier -->
  <resolver:AttributeDefinition xsi:type="ad:Simple" id="emailNameID" sourceAttributeID="email">
    <resolver:Dependency ref="email" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
      nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
   </resolver:AttributeDefinition>

(3) Configure your IDP to release the NameID to (at least) the SP in question.
Add the following to your attribute-filter.xml, again removing spaces
from the string being the SP's entityID (in the 'value' XML-attribute, below):

  <afp:AttributeFilterPolicy id="EmailNameID4PagerDuty">
    <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
      value="https :// ge-appliances.pagerduty.com" />
      <afp:AttributeRule attributeID="emailNameID">
        <afp:PermitValueRule xsi:type="basic:ANY" />
      </afp:AttributeRule>
  </afp:AttributeFilterPolicy>

That should do it.
-peter
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ge-appliances.xml
Type: application/xml
Size: 495 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150602/85fe991b/attachment.wsdl>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ge-appliances.zip
Type: application/zip
Size: 441 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150602/85fe991b/attachment.zip>