Using IDP V3 for SSO with AWS

[Wessel, Keith]

All,

Thanks for the input and suggestions.

Turns out it had nothing to do with the SAML encryption or signing. One of the attributes passed, called awsRoles, is a list of roles the user should have. I foolishly thought it should have each role as a separate value. Turn out all values get put into a single comma-separated string.

We're up and running now.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Michael A Grady
Sent: Wednesday, November 18, 2015 8:35 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Using IDP V3 for SSO with AWS


> On Nov 18, 2015, at 4:32 PM, Brent Putman <putmanb at georgetown.edu> wrote:
> 
> 
> 
> On 11/18/15 5:12 PM, Wessel, Keith wrote:
>>      <rp:ProfileConfiguration         xsi:type="saml:SAML2SSOProfile"       
>> includeAttributeStatement="true"        assertionLifetime="PT5M" assertionProxyCount="0"        signResponses="never" signAssertions="always"        encryptAssertions="never" encryptNameIds="never"        includeConditionsNotBefore="true"        maximumSPSessionLifetime="PT1H" />
>>  </rp:RelyingParty>
>> 
>> Based on what I think I've found the defaults for SAML2SSO, I've added the following override block to my V3 relying-party.xml:
>> 
>>         <bean parent="RelyingPartyByName" c:relyingPartyIds="urn:amazon:webservices">
>>             <property name="profileConfigurations">
>>                 <list>
>>                     <bean parent="SAML2.SSO" p:encryptAssertions="false"
>>                         p:signResponses="false" p:signAssertions="true" />
>>                 </list>
>>             </property>
>>         </bean>
> 
> Off-hand I'm not seeing any obvious problems with that
> 
>>        
>> 
>> 
>> Am I missing something? Or is the relying party configuration not the issue? Anyone have advice for other pieces of the IDP configuration where I might have gone astray?
>> 
> 
> 
> I've never setup AWS, so I can't offer specific IdP config suggestions but:  If you have a v2 IdP working with AWS, then you might just capture (via Firefox SAML Tracer, etc) the working v2 Response and the non-working v3 Response, and compare them.  Find the significant deltas and work back from there to the necessary config changes.

What about SHA-1 vs SHA-256 signing algorithm? Default in v3 is 256, while, unless you changed it for the whole v2 IdP, it was SHA-1 for v2.


--
Michael A. Grady
IAM Architect, Unicon, Inc.

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net