Google Apps with IdPv3

[Glenn Wearen]

Thanks for the advice, which I’ve applied successfully…

1. relying-party.xml

 <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByName" c:relyingPartyIds="google.com/a">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" p:encryptAssertions="false" /> 
                </list>
            </property>
        </bean>
 </util:list>

2. saml-nameid.xml

<util:list id="shibboleth.SAML2NameIDGenerators">
        <ref bean="shibboleth.SAML2TransientGenerator" />
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'Gprincipal'} }" />
    </util:list>

Where Gprincipal is a simple attribute definition (without a legacy style attribute encoder) in attribute-resolver.xml and is released in my attribute-filter.


Kind Regards
Glenn
HEAnet Limited, Ireland's Education and Research Network - 
1st Floor, 5 George's Dock, IFSC, Dublin 1
Registered in Ireland, no 275301  tel: +353-1-6609040  fax: +353-1-6603666

> On 19 Mar 2015, at 16:58, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> I haven't tested it with google apps but yes have generated a response with
>> unspecified.  in attribute resolver I created an attribute :
> 
> That all works, but is a deprecated approach.
> 
>> Finally in saml-nameid.properties i set the default to unspecified:
>> 
>> idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-
>> format:unspecified
> 
> Not how you want to control formats, unless you're only using Google SPs of course.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net