ArcGIS on Shib 3

[Peter Schober]

* McKean, Brandon Scott - mckeanbs <mckeanbs at jmu.edu> [2015-06-25 18:04]:
> Added this to saml-nameid.properties:
> 
> idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

As Scott said, don't do that.
Instead put it into the SPs SAML metadata.

> <afp:AttributeFilterPolicy>
>               <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="jmu.maps.arcgis.com" />
>                   <afp:AttributeRule attributeID="principal">
>                   <afp:PermitValueRule xsi:type="basic:ANY" />
>               </afp:AttributeRule>
> <afp:AttributeRule attributeID="mail">
>                     <afp:PermitValueRule xsi:type="basic:ANY" />
>                             </afp:AttributeRule>
> 
>         <afp:AttributeRule attributeID="givenName">
>                     <afp:PermitValueRule xsi:type="basic:ANY" />
>                             </afp:AttributeRule>
>       </afp:AttributeFilterPolicy>

You can remove out the attribute rule for attributeID="principal" (an
artifact from the v2-based ArcGIS documentation, I'm assuming).

Other than that it looks OK, so make sure the account tested with does
in fact have an email address, the IDP is allowed to see it, etc.
-peter