ArcGIS on Shib 3

[McKean, Brandon Scott - mckeanbs]

Tony,
I got the commonname and email address flow working. Surname I haven't
tried, but, it's literally a one letter difference in configuration
from cn.
The thing that was tripping me up for a while is having to make sure
all attributes used in the nameid generation are explicitly allowed to
arcgis in attribute-filter.xml
Here's some examples from mine:
attribute-filter.xml: (You'd need to add sn here if you want to use
that)
<afp:AttributeFilterPolicy id="releaseToArcGIS">
              
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="JMU.maps.arcgis.com" />
<afp:AttributeRule attributeID="cn">
     
                <afp:PermitValueRule xsi:type="basic:ANY" />
           
                  </afp:AttributeRule>
 
 
<afp:AttributeRule attributeID="mail">
                     <afp:PermitValueRule xsi:type="basic:ANY" />
                             </afp:AttributeRule>
 
         <afp:AttributeRule attributeID="givenName">
                     <afp:PermitValueRule xsi:type="basic:ANY" />
                             </afp:AttributeRule>
       </afp:AttributeFilterPolicy>
 
 
 
 
 
 
My attribute resolver looks like this:
 
<resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail">
        <resolver:Dependency ref="jmuad" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
    </resolver:AttributeDefinition>
 
<resolver:AttributeDefinition xsi:type="ad:Simple" id="cn" sourceAttributeID="cn">
            <resolver:Dependency ref="jmuad" />
                    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:cn" />
                            <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.3" friendlyName="cn" />
                                </resolver:AttributeDefinition>
 
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="givenName" sourceAttributeID="givenName">
            <resolver:Dependency ref="jmuad" />
                    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" />
                            <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" />
                                </resolver:AttributeDefinition>
 
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="sn" sourceAttributeID="sn">
            <resolver:Dependency ref="jmuad" />
                    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" />
                            <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" />
                                </resolver:AttributeDefinition>
 
 
 
 
Then the saml-nameid.xml: (You could have it source from sn instead if you wanted.)
 
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"
            p:attributeSourceIds="cn" />
Lastly you need to make sure that nameid format is being used for
arcgis. I'm currently doing it globally in relying-party.xml since it's
a testbox, but the right way would be adding it to the metadata. (I'm
just calling it eid at the end because that's what we refer to them
here. You could just as easily do uid, cn, sn, etc, you just need to
make sure it matches what is set to be sent to them.)
Hope this helps!
Brandon McKean
On Thu, 2015-06-25 at 16:29 -0400, Tony Skalski wrote:
> Brandon,
> 
> Are you seeing surname and email address flow into Arcgis.com? We
> have been able to get the auth to work but unable to get surname and
> email address working. 
> 
> On Thursday, June 25, 2015, McKean, Brandon Scott - mckeanbs <
> mckeanbs at jmu.edu> wrote:
> > Thanks for the tip! Turns out I was confused of the use of the
> > config files. I was putting these things in attribute-resolver
> > -ldap.xml rather than attribute-resolver.xml Having put them into
> > the right place they now work as expected.
> > 
> > Brandon McKean
> > 
> > On Thu, 2015-06-25 at 21:53 +0200, Peter Schober wrote:
> > > * McKean, Brandon Scott - mckeanbs <mckeanbs at jmu.edu> [2015-06-25
> > > 21:46]:
> > > > The first one being the mail attribute definition. I see it's
> > > > set to
> > > > construct that from the uid and add a domain of your choosing,
> > > > but I
> > > > was hoping to get that pulled straight from LDAP. Is there a
> > > > way to
> > > > do that?
> > > 
> > > Sure, if the software couldn't pass around email addresses, but
> > > only
> > > uids, that would be pretty broken.
> > > 
> > > > <resolver:AttributeDefinition id="mail" xsi:type="ad:Simple">
> > > >        
> > > > <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> > > > name="urn:mace:dir:attribute-def:mail" encodeType="false" />
> > > >        
> > > > <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> > > > name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"
> > > > encodeType="false" />
> > > > </resolver:AttributeDefinition>
> > > 
> > > Your previously sent version looked better, as it included
> > > sourceAttributeID="mail" in the AttributeDefinition and a child
> > > element of <resolver:Dependency ref="jmuad" /> referencing the
> > > DataConnector that should be able to provide the "mail"
> > > attribute.
> > > They're both missing from your example above.
> > > 
> > > But do consult the documentation, for IDPv3 it's this (or
> > > something in
> > > that vicinity):
> > > https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDef
> > > initionConfiguration
> > > -peter
> 
> -- 
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150625/e5501e1c/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5673 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150625/e5501e1c/attachment-0001.bin>