Shibboleth IdP with Webex

[Christopher Bongaarts]

On 11/4/2015 1:20 PM, David Swartz wrote:
>
> We had the same issue, basic SSO was working but not auto account 
> creation.  Our issue was solved by creating some very "simple" 
> attributes just for WebEx.  The problem was that WebEx doesn't 
> understand the urn:oid naming scheme, rejects attributes that have 
> "friendlyName" values, and demands that the name format be "unspecified."

I believe the nameFormat only applies to the NameID, and email works as 
well as unspecified (but transient, which is used by the usual default 
NameID, does not).

Also, unlike LDAP, givenName is a required field.  We use a scripted 
attribute to insert a "-" for accounts that lack one (e.g. departmental 
accounts, Madonna, Prince, etc.):

     <resolver:AttributeDefinition id="webexFirstname" xsi:type="Script" 
xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="givenName">
         <resolver:Dependency ref="umnLDAP" />
         <resolver:AttributeEncoder xsi:type="SAML2String" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="firstname" />
      <!-- wanted to use a Template attribute type here,
           but unfortunately it requires that all input
           parameters have same number of values. -->
         <Script><![CDATA[
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
            webexFirstname = new BasicAttribute("webexFirstname");

            var givenName;

            if (givenName != null && givenName.getValues().size() > 0) {
                gnvalue = givenName.getValues().get(0);
            } else {
                gnvalue = "-";
            }

            webexFirstname.getValues().add(gnvalue);
          ]]></Script>
     </resolver:AttributeDefinition>

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%