ArcGIS on Shib 3

[Rich Graves]

They're special. As Peter mentioned, they expect to get full name (Firstname Lastname) from the givenName attribute. It's possible to work around this but we haven't bothered.

They have changed the cAsE of our entityIds twice without notice or explanation. Now we have several variations in relying-parties.xml. 

Their SSO configuration form has a field for attribute mapping. However, they eventually acknowledged that it probably does not actually do anything. Accept that you need to give them username as NameID. You're probably defaulting to transientId. Here's one way (not necessarily the best way) to allow username and explicitly deny transientId to specific SPs. Then you allow your username attribute, which we (mis)labeled "principal."

    <!-- Google Attribute Release Policy -->
    <!-- see also http://doc.arcgis.com/en/arcgis-online/reference/configure-shibboleth.htm -->
    <AttributeFilterPolicy id="releasePrincipal">
        <PolicyRequirementRule xsi:type="basic:OR">
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="google.com" />
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="carleton.maps.arcgis.com" />
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="carletonadmin.maps.arcgis.com" />
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="Carleton-Admin.maps.arcgis.com" />
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="Carleton-Admin.maps.ArcGIS.com" />
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="Carleton-admin.maps.arcgis.com" />
        </PolicyRequirementRule>
        <AttributeRule attributeID="principal">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>

    <!--  Release the transient ID to anyone (except google and arcgis) -->
    <AttributeFilterPolicy id="releaseTransientIdToAnyone">
         <PolicyRequirementRule xsi:type="basic:AND">
                 <basic:Rule xsi:type="basic:NOT">
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="google.com" />
                 </basic:Rule>
                 <basic:Rule xsi:type="basic:NOT">
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="carleton-admin.maps.arcgis.com" />
                 </basic:Rule>
                 <basic:Rule xsi:type="basic:NOT">
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="Carleton-Admin.maps.arcgis.com" />
                 </basic:Rule>
                 <basic:Rule xsi:type="basic:NOT">
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="Carleton-Admin.maps.ArcGIS.com" />
                 </basic:Rule>
                 <basic:Rule xsi:type="basic:NOT">
                         <basic:Rule xsi:type="basic:AttributeRequesterString" value="Carleton-admin.maps.arcgis.com" />
                 </basic:Rule>
        </PolicyRequirementRule>
        <AttributeRule attributeID="transientId">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>

This results in debug log entries like

03:31:38.483 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:690] - Selecting attribute to be encoded as a name identifier by encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
03:31:38.483 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:717] - Selecting the first attribute that can be encoded in to a name identifier
03:31:38.483 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:501] - Name identifier for relying party 'google.com' will be built from attribute 'principal'
03:31:38.483 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:868] - Using attribute 'principal' supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified' to create the NameID for relying party 'google.com'