Google Apps with IdPv3

[Andrew Morgan]

It's hard to say without knowing what your IDP is sending to Google.  Do 
you have the SAML Response somewhere?  I like using the SAML Tracer add-on 
in Firefox to look at SAML.

 	Andy

On Mon, 1 Jun 2015, khuether at mcdaniel.edu wrote:

> Hi everyone,
>
> I had followed the instructions here, but I'm getting a message that "this account cannot be accessed because the login credentials could not be verified." I've checked in the logs that the principal is being sent correctly. Does anyone have any advice?
>
> Thanks!
> Kenny
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Dave Perry
> Sent: Thursday, May 28, 2015 10:13 AM
> To: Shib Users
> Subject: RE: Google Apps with IdPv3
>
> Glenn
>
> What was your attribute-resolver definition, if you wouldn't mind sharing that please?
>
> Thanks,
> Dave
>
> _________________________________________________
> Dave Perry
> eLearning Technologist, Hull College Group
>
> Room L34 - Queens Gardens Library
> Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG Extension 2230 / Direct Dial 01482 381930
>
> * Need a fast reply? Try elearning at hull-college.ac.uk *
>
>
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Glenn Wearen
> Sent: 19 March 2015 21:07
> To: Shib Users
> Subject: Re: Google Apps with IdPv3
>
> Thanks for the advice, which I’ve applied successfully…
>
> 1. relying-party.xml
>
> <util:list id="shibboleth.RelyingPartyOverrides">
>        <bean parent="RelyingPartyByName" c:relyingPartyIds="google.com/a">
>            <property name="profileConfigurations">
>                <list>
>                    <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" p:encryptAssertions="false" />
>                </list>
>            </property>
>        </bean>
> </util:list>
>
> 2. saml-nameid.xml
>
> <util:list id="shibboleth.SAML2NameIDGenerators">
>        <ref bean="shibboleth.SAML2TransientGenerator" />
>        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
>            p:attributeSourceIds="#{ {'Gprincipal'} }" />
>    </util:list>
>
> Where Gprincipal is a simple attribute definition (without a legacy style attribute encoder) in attribute-resolver.xml and is released in my attribute-filter.
>
>
> Kind Regards
> Glenn
> HEAnet Limited, Ireland's Education and Research Network - 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301  tel: +353-1-6609040  fax: +353-1-6603666
>
>> On 19 Mar 2015, at 16:58, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>>> I haven't tested it with google apps but yes have generated a
>>> response with unspecified.  in attribute resolver I created an attribute :
>>
>> That all works, but is a deprecated approach.
>>
>>> Finally in saml-nameid.properties i set the default to unspecified:
>>>
>>> idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-
>>> format:unspecified
>>
>> Not how you want to control formats, unless you're only using Google SPs of course.
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> **********************************************************************
> This message is sent in confidence for the addressee only. It may  contain confidential or sensitive information.  The contents are not to be disclosed to anyone other than the addressee.  Unauthorised recipients are requested to preserve this confidentiality and to advise us of any errors in transmission.  Any views expressed in this message are solely the views of the individual and do not represent the views of the College.  Nothing in this message should be construed as creating a contract.
>
> Hull College owns the email infrastructure, including the contents.
>
> Hull College is committed to sustainability, please reflect before printing this email.
> **********************************************************************
>
> TEXT
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net