SAML Salesforce Reponse coming in Transient Format
Cahill, Charles (GE Appliances)
Charles.Cahill at ge.com
Tue Nov 17 15:39:43 EST 2015
I was able to fix this problem by telling salesforce to accept our basic uid attribute back. There was no need to send the header back in the subjectname.
In the admin console for sales force you can tell it the name of the attribute want back, which in our case was uid and tell it to accept it back as urn:oasis:names:tc:SAML:2.0:attrname-format:basic
Charles Cahill
Senior Technologist - Authentication/Authorization
TAS App Svcs, SSO/LDAP/Web Application Support
GE Appliances & Lighting
GE Appliance Park
Louisville, Ky/40225
GE imagination at work
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Clayton
Sent: Tuesday, November 17, 2015 3:39 PM
To: users at shibboleth.net
Subject: Re: SAML Salesforce Reponse coming in Transient Format
I'm trying to understand this and am looking at the metadata for one of our SP's.
What part of this SP metadata tells our Shib IdP which NameID format to select?
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_456789987b9c1c0c917e2fe4379f68ea45678987" entityID="https://xxxxxxxxxxxxxcom">
<md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
</md:Extensions>
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
<md:Extensions>
<init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth..sso/Login"/>
</md:Extensions>
<md:KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>rd00155de1e7c0</ds:KeyName>
<ds:X509Data>
<ds:X509SubjectName>CN=rd00235de1e7ff</ds:X509SubjectName>
<ds:X509Certificate>xxxxxxx==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes192-gcm"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
</md:KeyDescriptor>
<md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/Artifact/SOAP" index="1"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/SOAP"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/Redirect"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/POST"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SLO/Artifact"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/POST" index="1"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/Artifact" index="3"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML2/ECP" index="4"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML/POST" index="5"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://xxxxxxxxxxxxxxxxxxxcom/Shibboleth.sso/SAML/Artifact" index="6"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>
--Clayton
"Shib Users users-at-shibboleth.net |Shib|" <3unnche4it at sneakemail.com<mailto:3unnche4it at sneakemail.com>> on Friday, November 13, 2015 at 3:34 PM -0500 wrote:
On 11/13/15, 3:14 PM, "users on behalf of Cahill, Charles (GE Appliances)" wrote:
>I am still really confused on this. I changed the nameid-format to persistent, but it
>is still coming back in the saml response as transient.
I don't know what that means or what you changed..
There is configuration for generating NameIDs in various formats as required, and then you have machinery in various places that controls the selection of the format, principally the SP's metadata.
Beyond that it depends on the version.
V3
https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration
V2 (much harder to follow, but that's what you get for running code a year or more out of date)
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
-- Scott
--
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151117/e6a06855/attachment-0001.html>
More information about the users
mailing list