ArcGIS on Shib 3

[McKean, Brandon Scott - mckeanbs]

I managed to get it working!
Thanks for the tips, it turns out the reason it was failing at that
part was the attribute-filter wasn't quite refined right, hence the
attribute wasn't passed as part of that.
With that working though, there were a couple shortcuts I made that I'd
like to fix. The first one being the mail attribute definition. I see
it's set to construct that from the uid and add a domain of your
choosing, but I was hoping to get that pulled straight from LDAP. Is
there a way to do that? I had tried the following, but it didn't work.
<resolver:AttributeDefinition id="mail" xsi:type="ad:Simple">
       
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:mail" encodeType="false" />
       
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"
encodeType="false" />
</resolver:AttributeDefinition>


Any thoughts?

Thanks,

Brandon Mckean
On Thu, 2015-06-25 at 18:18 +0200, Peter Schober wrote:
> * McKean, Brandon Scott - mckeanbs <mckeanbs at jmu.edu> [2015-06-25
> 18:04]:
> > Added this to saml-nameid.properties:
> > 
> > idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid
> > -format:emailAddress
> 
> As Scott said, don't do that.
> Instead put it into the SPs SAML metadata.
> 
> > <afp:AttributeFilterPolicy>
> >               
> > xsi:type="basic:AttributeRequesterString"
> > value="jmu.maps.arcgis.com" />
> >                   <afp:AttributeRule attributeID="principal">
> >                   <afp:PermitValueRule xsi:type="basic:ANY" />
> >               </afp:AttributeRule>
> > <afp:AttributeRule attributeID="mail">
> >                     <afp:PermitValueRule xsi:type="basic:ANY" />
> >                             </afp:AttributeRule>
> > 
> >         <afp:AttributeRule attributeID="givenName">
> >                     <afp:PermitValueRule xsi:type="basic:ANY" />
> >                             </afp:AttributeRule>
> >       </afp:AttributeFilterPolicy>
> 
> You can remove out the attribute rule for attributeID="principal" (an
> artifact from the v2-based ArcGIS documentation, I'm assuming).
> 
> Other than that it looks OK, so make sure the account tested with
> does
> in fact have an email address, the IDP is allowed to see it, etc.
> -peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150625/f8f5f01b/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150625/f8f5f01b/attachment-0001.bin>