ArcGIS on Shib 3

[McKean, Brandon Scott - mckeanbs]

So I think I've got something that gets close to achieving this, but I'm having a bit of trouble and maybe someone could help fill the gaps.

So far I've uncommented and modified saml-nameid.xml to add this:

<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="mail" />


Added this to saml-nameid.properties:

idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress


I've got this in attribute-resolver-ldap.xml:

<resolver:AttributeDefinition xsi:type="ad:Simple" id="mail" sourceAttributeID="mail">
            <resolver:Dependency ref="jmuad" />
                    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" />
                            <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
                                </resolver:AttributeDefinition>




And attribute-filter.xml:


<afp:AttributeFilterPolicy>
              <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="jmu.maps.arcgis.com" />
                  <afp:AttributeRule attributeID="principal">
                  <afp:PermitValueRule xsi:type="basic:ANY" />
              </afp:AttributeRule>
<afp:AttributeRule attributeID="mail">
                    <afp:PermitValueRule xsi:type="basic:ANY" />
                            </afp:AttributeRule>

        <afp:AttributeRule attributeID="givenName">
                    <afp:PermitValueRule xsi:type="basic:ANY" />
                            </afp:AttributeRule>
      </afp:AttributeFilterPolicy>



Yep this is what I get in logs when I try to login:

2015-06-25 11:50:32,750 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:183] - Checking for source attribute mail
2015-06-25 11:50:32,751 - INFO [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:213] - Attribute sources [mail] did not produce a usable identifier


Perhaps I'm missing something? I didn't add to metadata yet just because this box is dedicated to testing them, so I figured I'd set it in saml-nameid.properties

Thanks,

Brandon McKean




-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, June 25, 2015 10:01 AM
To: Shib Users
Subject: Re: ArcGIS on Shib 3

On 6/25/15, 9:56 AM, "users on behalf of Rich Graves" <users-bounces at shibboleth.net on behalf of rgraves at carleton.edu> wrote:



>Their SSO configuration form has a field for attribute mapping. However, they eventually acknowledged that it probably does not actually do anything. Accept that you need to give them username as NameID. You're probably defaulting to transientId. Here's one way (not necessarily the best way) to allow username and explicitly deny transientId to specific SPs. Then you allow your username attribute, which we (mis)labeled "principal."

That's all old advice, even for V2.

To support a custom NameID format:

1. Define and release an attribute to that SP containing the data to supply.
2. Pick a format.
3. Add that format constant to the SP's metadata in a <NameIDFormat> element.
4. Configure saml-nameid.xml to support the format by uncommenting the attribute-sourced NameID generator plugin and telling it the format to use and the attribute ID to pull from.

Easy squeezy.

In the rare cases you can't manipulate the metadata, you can specify the format for the SP in a property in a custom RelyingParty definition for the SP.

You should *never* need to "deny" release of anything to get this to work, and in V3 there is no "transient" attribute ID to control the release of anyway.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net