Box.net integration with shib 2.x

[Robert Roll]

  We did NOT actually create a specific relying-party entry for Box. The default
one seems to work for us with their  standard entityID=https://services.box.com/sp

I have included below our attribute-filter policy for anything it might be worth.

Box does really seem to key off of Primary e-mail address. They also seem to want
any potential e-mail aliases a user might want...

Robert

<afp:AttributeFilterPolicy id="Box.com" >

 <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://services.box.com/sp" />

        <afp:AttributeRule attributeID="transientId"> 
            <afp:DenyValueRule xsi:type="basic:ANY" /> 
        </afp:AttributeRule> 

  <afp:AttributeRule attributeID="eduPersonPrincipalName">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>

  <afp:AttributeRule attributeID="displayName">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>

  <afp:AttributeRule attributeID="commonName">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
  <afp:AttributeRule attributeID="surname">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
  <afp:AttributeRule attributeID="givenName">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>
  <afp:AttributeRule attributeID="eduPersonAffiliation">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>


  <afp:AttributeRule attributeID="uuBOXmailProxyaddresses">
    <afp:PermitValueRule xsi:type="basic:ANY" />
  </afp:AttributeRule>

</afp:AttributeFilterPolicy>


<!-- Box Primary E-mail -->
<!--  For Box releasing primary_email is the key that the individual should receive a UofU Box account.
      The policy is for anyone whois a current student or staff. Also, special uuPOI people

           10035 Incoming New Hires Incoming
           10039 Nursing Student University of Utah
           10040 Other Clinical Student University
           10043 U Asia Campus Employee
-->

<afp:AttributeFilterPolicy>
      <afp:PolicyRequirementRule xsi:type="basic:AND">
          <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://services.box.com/sp" />
          <basic:Rule xsi:type="basic:OR">
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="eduPersonAffiliation" value="staff" ignoreCase="true" />
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="eduPersonAffiliation" value="student" ignoreCase="true" />
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="uuPOItype" value="10035" />
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="uuPOItype" value="10039" />
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="uuPOItype" value="10040" />
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="uuPOItype" value="10043" />
          </basic:Rule>
      </afp:PolicyRequirementRule>
 
      <afp:AttributeRule attributeID="uuBOXprimaryEmail">
          <afp:PermitValueRule xsi:type="basic:ANY" />
      </afp:AttributeRule>
 
</afp:AttributeFilterPolicy>

________________________________________
From: users [users-bounces at shibboleth.net] on behalf of Rich Graves [rgraves at carleton.edu]
Sent: Thursday, June 11, 2015 9:26 AM
To: users
Subject: Box.net integration with shib 2.x

Could someone do my homework for me and share a working relying-party.xml snippet for box.net + shib 2.x, as well as any history as to what parameters box might have needed to tweak on their end?

Our Box support tech and I are equally bewildered at the large number of possible permutations of entityID="box.net" (apparently their default) versus entityID="https://services.box.com/sp" (included in InCommon metadata), to encryptAssertions and encryptNameIds or not, etc. We haven't found a combination that works yet. We are still in trial mode so all I'm getting is (apparently) low-priority email support.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net