Shibboleth IdP with Webex

Sacilowski, Tadeusz ts2878 at tc.columbia.edu
Thu Nov 5 12:20:51 EST 2015 

Hi All,

So I'm still having some issues with the WebEx auto account creation. The
error message on the WebEx side shows "Auto Account Creation failed (31)".
I've added the following to my attribute.resolver.xml:

<!-- BEGIN: Attributes for WebEx auto account creation -->
<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExUid"
sourceAttributeID="uid">
     <resolver:Dependency ref="myLDAP" />
     <resolver:AttributeEncoder xsi:type="enc:SAML2String"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
name="uid" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExFirstname"
sourceAttributeID="givenName">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
name="firstname" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExLastname"
sourceAttributeID="sn">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
name="lastname" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExEmail"
sourceAttributeID="mail">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
name="email" />
</resolver:AttributeDefinition>
<!-- END: Attributes for WebEx auto account creation -->

And I'm releasing them to WebEx as such (we will have multiple WebEx sites,
hence the "basic:OR" for AttributeRequesterString):

<!-- Release WebEx attributes -->
<afp:AttributeFilterPolicy id="releaseToWebEx">
    <afp:PolicyRequirementRule xsi:type="basic:OR">
        <basic:Rule xsi:type="basic:AttributeRequesterString" value="
http://www.webex.com" />
        <basic:Rule xsi:type="basic:AttributeRequesterString" value="
https://www.webex.com" />
    </afp:PolicyRequirementRule>

    <afp:AttributeRule attributeID="WebExUid">
         <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>

    <afp:AttributeRule attributeID="WebExFirstname">
        <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>

    <afp:AttributeRule attributeID="WebExLastname">
        <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>

    <afp:AttributeRule attributeID="WebExEmail">
        <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
</afp:AttributeFilterPolicy>

I see the values being populated in my logs... not sure what I'm doing
wrong. Hoping maybe someone might have some insight as I wait for a
response from their support folks.

Thanks!
Teddy



*Tadeusz Sacilowski*
*Enterprise Architect & Security Engineer*
Teachers College, Columbia University
ts2878 at tc.columbia.edu

On Wed, Nov 4, 2015 at 2:20 PM, David Swartz <dswartz at hamilton.edu> wrote:

> Hi Teddy,
>
> We had the same issue, basic SSO was working but not auto account
> creation.  Our issue was solved by creating some very "simple" attributes
> just for WebEx.  The problem was that WebEx doesn't understand the urn:oid
> naming scheme, rejects attributes that have "friendlyName" values, and
> demands that the name format be "unspecified."
>
> For example, here is our normal mail attribute:
>
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="email"
> sourceAttributeID="mail">
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:mail" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="urn:oid:0.9.2342.19200300.100.1.3" />
>     </resolver:AttributeDefinition>
>
> Here's what the custom mail attribute for WebEx looks like:
>
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExEmail"
> sourceAttributeID="mail">
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
> name="email" />
>     </resolver:AttributeDefinition>
>
> Once we made these custom attributes, and ensured that we were only
> sending the four attributes they wanted (uid, firstname, lastname, email)
> auto account creation began working.
>
>
> -------------------------------------------------------------
> David Swartz
> Network/Systems Administrator
> Hamilton College - ITS Network Services
> 315.859.4918 , dswartz at hamilton.edu
> -------------------------------------------------------------
>
> On Wed, Nov 4, 2015 at 1:36 PM, Sacilowski, Tadeusz <
> ts2878 at tc.columbia.edu> wrote:
>
>> Hi All,
>>
>> We're also in the process of setting up WebEx to use our Shibboleth IdP.
>> I've gotten SSO to work but am stuck at the auto account creation/update...
>> any chance anyone is willing to share what they did for these?
>>
>> Thank you,
>> Teddy
>>
>>
>> *Tadeusz Sacilowski*
>> *Enterprise Architect & Security Engineer*
>> Teachers College, Columbia University
>> ts2878 at tc.columbia.edu
>>
>> On Thu, Jul 23, 2015 at 4:29 PM, Mark Boyce <Mark.Boyce at ucop.edu> wrote:
>>
>>> Andrew,
>>>
>>>
>>>
>>> I would appreciate any guidance you may be able to provide…
>>>
>>>
>>>
>>>
>>>
>>> Thanks,
>>>
>>>
>>>
>>> Mark
>>>
>>>
>>>
>>> *Mark L. Boyce*
>>>
>>> Senior Identity Management Analyst
>>>
>>> University of California, Office of the President
>>>
>>> 415 20th Street
>>>
>>> Oakland, CA 94612
>>>
>>> Office: 510.987.9681
>>>
>>> Cell: 209.851.0196
>>>
>>>
>>>
>>> *From:* users-bounces at shibboleth.net [mailto:
>>> users-bounces at shibboleth.net] *On Behalf Of *Todd, James
>>> *Sent:* Thursday, September 11, 2014 3:54 AM
>>> *To:* Shib Users
>>> *Subject:* RE: Shibboleth IdP with Webex
>>>
>>>
>>>
>>> Thank you all for your assistance – Andrew Martin provided some
>>> assistance off-list and some further tweaks mean I now have a working
>>> federated login with auto-account create. All down to encryption of
>>> assertions in the end.
>>>
>>>
>>>
>>> Cheers
>>>
>>> James
>>>
>>>
>>>
>>>
>>> *_____________________________________ James Todd* | Data Centre &
>>> Operations Analyst
>>>
>>> *Edinburgh Napier University*
>>> Craiglockhart Campus
>>> Edinburgh
>>> EH14 1DJ
>>>
>>> Tel: 0131 455 4313
>>> Email: j.todd at napier.ac.uk
>>>
>>>
>>>
>>> *From:* users-bounces at shibboleth.net [
>>> mailto:users-bounces at shibboleth.net <users-bounces at shibboleth.net>] *On
>>> Behalf Of *Todd, James
>>> *Sent:* 10 September 2014 09:43
>>> *To:* users at shibboleth.net
>>> *Subject:* Shibboleth IdP with Webex
>>>
>>>
>>>
>>> Hi Group,
>>>
>>>
>>>
>>> I’d like some guidance primarily from those who have already got Shib
>>> and Webex working together here as I gather from other posts I’ve seen it’s
>>> not entirely straightforward as other setups.
>>>
>>>
>>>
>>> I’ve been trying to federate with Webex using our 2.3.8 IdP, using the
>>> documentation provided by Cisco (which seems heavily geared towards helping
>>> those using ADFS) and I’m hitting a brick wall. I’ve added the Webex
>>> metadata, I’ve pulled together the required attributes in the resolver
>>> (uid, email, firstname, lastname) and configured a webex nameid and used
>>> the uid for that. I’ve configured the attribute filter to remove all the
>>> unwanted attributes we usually release as default for other SPs.  I’ve
>>> configured the webex side to point at our IdP, I’ve added our IdP metadata
>>> and all that good stuff.
>>>
>>> So when it comes to Webex login it correctly redirects to our IdP and
>>> our IdP redirects back to Webex, from the logs I can see the attributes I
>>> want sent are being sent - but webex fails to login with the error “*Reason:
>>> *Invalid Response message (29)” obviously that means that something’s
>>> wrong with my assertion but the documentation is of no help and as I’ve
>>> already said geared heavily to an ADFS implementation.
>>>
>>> So, has anybody already successfully done this, and do they have any
>>> pointers?
>>>
>>> Cheers
>>>
>>> James
>>>
>>>
>>> *_____________________________________ James Todd* | Data Centre &
>>> Operations Analyst
>>>
>>> *Edinburgh Napier University*
>>> Craiglockhart Campus
>>> Edinburgh
>>> EH14 1DJ
>>>
>>> Tel: 0131 455 4313
>>> Email: j.todd at napier.ac.uk
>>>
>>>
>>>
>>> *** IT Support is now available 24 hrs a day, 365 days of the year ***
>>>
>>>
>>>
>>> For Help and Advice on any of our IT services please visit:
>>>
>>> Staff Intranet:
>>> http://staff.napier.ac.uk/services/cit/Pages/info-services.aspx
>>>
>>> Student Portal:
>>> https://studentportal.napier.ac.uk/citservices/default.aspx
>>>
>>>
>>>
>>> [image: CSE logo 2014]
>>>
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151105/a085db4c/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 4307 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20151105/a085db4c/attachment-0001.jpg>

More information about the users mailing list