IDP 2.5.0 relying-party.xml file for Cisco WebEx?

[David Swartz]

We had to create a new RelyingParty entry specifically for WebEx so that we
could disable encrypting assertions.

Here is the entry we added, note that I have obfuscated the ID and provider
links.

    <rp:RelyingParty id="https://whatever.webex.com" provider="
https://MyShibSite.edu/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential"
defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">

        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
includeAttributeStatement="true"
                                 assertionLifetime="PT3M"
assertionProxyCount="0"
                                 signResponses="conditional"
signAssertions="always"
                                 encryptAssertions="never"
encryptNameIds="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
includeAttributeStatement="true"
                                 assertionLifetime="PT3M"
assertionProxyCount="0"
                                 signResponses="conditional"
signAssertions="always"
                                 encryptAssertions="never"
encryptNameIds="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
                                 assertionLifetime="PT3M"
assertionProxyCount="0"
                                 signResponses="conditional"
signAssertions="never"
                                 encryptAssertions="never"
encryptNameIds="never"/>

        <rp:ProfileConfiguration
xsi:type="saml:SAML2ArtifactResolutionProfile"
                                 signResponses="conditional"
signAssertions="always"
                                 encryptAssertions="never"
encryptNameIds="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"
                                 signResponses="conditional"/>

</rp:RelyingParty>



-------------------------------------------------------------
David Swartz
Network/Systems Administrator
Hamilton College - ITS Network Services
315.859.4918 , dswartz at hamilton.edu
-------------------------------------------------------------

On Tue, Nov 3, 2015 at 3:48 PM, Eric Wedaa <Eric.Wedaa at marist.edu> wrote:

> How did you configure your metadataProvider without editing
> relying-party.xml?
>
> Errors: For instance
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider
> says:
>     <MetadataProvider xsi:type="FilesystemMetadataProvider"
>                       id="InternalMetadata"
>                       metadataFile="/path/to/my/metadata-internal.xml" />
> But the error log says :
> 15:16:44.696 - ERROR
> [edu.internet2.middleware.shibboleth.common.config.BaseService:188] -
> Configuration was not loaded for
> shibboleth.RelyingPartyConfigurationManager service, error creating
> components.  The root cause of this error was:
> org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve
> 'FilesystemMetadataProvider' to a type definition for element
> 'metadata:MetadataProvider'.
>
> So either I messed up something, or the docs are wrong.
>
> Thanks1
>
> >>Ericw
>
> -----"users" <users-bounces at shibboleth.net> wrote: -----
> To: users at shibboleth.net
> From: Christopher Bongaarts
> Sent by: "users"
> Date: 11/03/2015 03:41PM
> Subject: Re: IDP 2.5.0 relying-party.xml file for Cisco WebEx?
>
> On 11/3/2015 2:35 PM, Eric Wedaa wrote:
> >    Does anybody have a working relying-party.xml file for Shibboleth IDP
> 2.5.0 that works for Cisco WebEx?
> >
> >    I have beat my head against the wall and, while having found several
> webpages that claim to tell you how to do it, none of them have worked.  I
> can get my IDP to talk to Shibboleth SPs and testshib.  All my attempts
> have spewed tomcat errors telling me that my relying-party.xml file is
> wrong.
>
> We did not have to make any changes to relying-party.xml to get WebEx
> working.
>
> We did have to define a bunch of extra attributes, since they require
> non-standard attribute names, and autoprovisioning fails spectacularly
> if your given name attribute is empty or only consists of whitespace (we
> hard code a "-" as the WebEx given name for accounts that lack one,
> using a scripted attribute).
>
> If your tomcat logs indicate relying-party errors, there should be an
> indication of what the problem is (if not in the Tomcat logs, in the
> Shibboleth idp-process.log).
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151103/62c1af03/attachment.html>