IDP 2.5.0 relying-party.xml file for Cisco WebEx?

[Eric Wedaa]

But what about your metadata?  How did you do that?

I'm sorry I'm so confused, but I've really tried at this and I'm just not a shibboleth guru.

>>Ericw

-----"users" <users-bounces at shibboleth.net> wrote: -----
To: Shib Users <users at shibboleth.net>
From: David Swartz 
Sent by: "users" 
Date: 11/03/2015 04:00PM
Subject: Re: IDP 2.5.0 relying-party.xml file for Cisco WebEx?

We had to create a new RelyingParty entry specifically for WebEx so that we could disable encrypting assertions.

Here is the entry we added, note that I have obfuscated the ID and provider links.  

    <rp:RelyingParty id="https://whatever.webex.com" provider="https://MyShibSite.edu/idp/shibboleth" defaultSigningCredentialRef="IdPCredential" defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
                
                              
        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true" 
                                 assertionLifetime="PT3M" assertionProxyCount="0" 
                                 signResponses="conditional" signAssertions="always" 
                                 encryptAssertions="never" encryptNameIds="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" includeAttributeStatement="true" 
                                 assertionLifetime="PT3M" assertionProxyCount="0" 
                                 signResponses="conditional" signAssertions="always" 
                                 encryptAssertions="never" encryptNameIds="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" 
                                 assertionLifetime="PT3M" assertionProxyCount="0" 
                                 signResponses="conditional" signAssertions="never" 
                                 encryptAssertions="never" encryptNameIds="never"/>
        
        <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" 
                                 signResponses="conditional" signAssertions="always" 
                                 encryptAssertions="never" encryptNameIds="never"/>

        <rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"
                                 signResponses="conditional"/>
                                                                 
        </rp:RelyingParty>



-------------------------------------------------------------
David Swartz
Network/Systems Administrator
Hamilton College - ITS Network Services
315.859.4918 , dswartz at hamilton.edu
------------------------------------------------------------- 
On Tue, Nov 3, 2015 at 3:48 PM, Eric Wedaa <Eric.Wedaa at marist.edu> wrote:
How did you configure your metadataProvider without editing relying-party.xml?
 
 Errors: For instance https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider says:
     <MetadataProvider xsi:type="FilesystemMetadataProvider"
                       id="InternalMetadata"
                       metadataFile="/path/to/my/metadata-internal.xml" />
 But the error log says :
 15:16:44.696 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.RelyingPartyConfigurationManager service, error creating components.  The root cause of this error was: org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve 'FilesystemMetadataProvider' to a type definition for element 'metadata:MetadataProvider'.
 
 So either I messed up something, or the docs are wrong.
 
 Thanks1
 
 >>Ericw
 
 -----"users" <users-bounces at shibboleth.net> wrote: -----
 To: users at shibboleth.net
 From: Christopher Bongaarts
 Sent by: "users"
 Date: 11/03/2015 03:41PM
 Subject: Re: IDP 2.5.0 relying-party.xml file for Cisco WebEx?
 
 On 11/3/2015 2:35 PM, Eric Wedaa wrote:
 >    Does anybody have a working relying-party.xml file for Shibboleth IDP 2.5.0 that works for Cisco WebEx?
 >
 >    I have beat my head against the wall and, while having found several webpages that claim to tell you how to do it, none of them have worked.  I can get my IDP to talk to Shibboleth SPs and testshib.  All my attempts have spewed tomcat errors telling me that my relying-party.xml file is wrong.
 
 We did not have to make any changes to relying-party.xml to get WebEx
 working.
 
 We did have to define a bunch of extra attributes, since they require
 non-standard attribute names, and autoprovisioning fails spectacularly
 if your given name attribute is empty or only consists of whitespace (we
 hard code a "-" as the WebEx given name for accounts that lack one,
 using a scripted attribute).
 
 If your tomcat logs indicate relying-party errors, there should be an
 indication of what the problem is (if not in the Tomcat logs, in the
 Shibboleth idp-process.log).
 
 --
 %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
 %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
 %%  University of Minnesota    %%  +1 (612) 625-1809    %%
 
 --
 To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
 --
 To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
 
 
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net