Federation with Concur?

[Cantor, Scott]

On 11/3/15, 11:09 AM, "users on behalf of David Gersic" <users-bounces at shibboleth.net on behalf of dgersic at niu.edu> wrote:



>In the metadata configuration, he has the entityID as  entityID="https://www.concursolutions.com" where I think it should be  entityID="https://www.concursolutions.com/"  The trailing slash is important. Maybe this changed between when he wrote it and now, but the XML I got from Concur has the trailing slash in it.

Mine does not.

>where it looks like Scoped:
>
>    <resolver:AttributeDefinition xsi:type="ad:Scoped" xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="ConcurNameID" scope="yourdomain.edu" sourceAttributeID="uid">
>        <resolver:Dependency ref="myLDAP" />
>            <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
>                xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" />
>    </resolver:AttributeDefinition>
>
> would be simpler, at least to me.

This isn't a scoped attribute, it's a custom attribute that's going to end up in a NameID and happens to have a domain in it. Scoped should never be used with formally unscoped data, it can completely alter the data serialization performed.

>Is there any effective difference here, assuming that domain.edu is the same for both definitions?

Very much so.

-- Scott