Google Apps with IdP v3 not working

[Dave Perry]

Ah right, I understand.
Context checking removed, I now have the email address going off to google via the mail attribute (I gave up with the dedicated attribute thing).
I did have to leave the changes you made to saml-nameid in though.


But, google claims it cannot process the login request (certificates snipped out):

    <saml2:Assertion ID="_629babeb23cf5212ddf44fed3dbe9a96"
        IssueInstant="2015-09-01T10:29:52.726Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Issuer>https://shibb.hull-college.ac.uk/idp/shibboleth</saml2:Issuer>
        <saml2:Subject>
            <saml2:NameID
                Format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
                NameQualifier="https://shibb.hull-college.ac.uk/idp/shibboleth" SPNameQualifier="google.com">Dave.Perry at hull-college.ac.uk</saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="10.3.1.87"
                    InResponseTo="eoikjlpfaenclpjacoaicalfpbobinkmhlkifpnc"
                    NotOnOrAfter="2015-09-01T10:34:52.846Z" Recipient="https://www.google.com/a/hull-college.ac.uk/acs"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2015-09-01T10:29:52.726Z" NotOnOrAfter="2015-09-01T10:34:52.726Z">
            <saml2:AudienceRestriction>
                <saml2:Audience>google.com</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2015-09-01T09:53:22.094Z" SessionIndex="_b78e48812b6ac1391c1bb9e7ae6606ab">
            <saml2:SubjectLocality Address="10.3.1.87"/>
            <saml2:AuthnContext>
                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>

How does that compare to one of your working ones?


Dave
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of David Langenberg
Sent: 28 August 2015 15:37
To: Shib Users
Subject: Re: Google Apps with IdP v3 not working


> On Aug 28, 2015, at 8:35 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 8/28/15, 10:29 AM, "users on behalf of Dave Perry" <users-bounces at shibboleth.net on behalf of Dave.Perry at hull-college.ac.uk> wrote:
> 
>> I haven't modified any context flows, it should just be the stock one that came with v3 installer (I didn't do an automated upgrade).
> 
> The event in the log is what the context-check intercept flow uses to block issuing a response. That isn't configured out of the box.

You may want to remote that context-check from your config if you copied my stuff directly.  We have a bit more going on behind the scenes (https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829) for which that context-check is being used.

Dave

--
David Langenberg
Identity & Access Management Architect
The University of Chicago



-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT