Google Apps with IdP v3 not working
Dave Perry
Dave.Perry at hull-college.ac.uk
Tue Sep 1 11:24:02 EDT 2015
Useful. The only difference I can find is that you aren't including your domain name in the NameID you send - we have several domains on our account, so I think I'll need to keep sending it. Another google chat in order I think!
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group
Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930
* Need a fast reply? Try elearning at hull-college.ac.uk *
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of David Langenberg
Sent: 01 September 2015 15:35
To: Shib Users
Subject: Re: Google Apps with IdP v3 not working
Here's mine:
<saml2p:Response Destination="https://www.google.com/a/uchicago.edu/acs"
ID="_493ab119bb6bb4e72daa3d007af201c7"
InResponseTo="joocmikcnkcejkmkikpncfpdgdopdkaifmnnaggg"
IssueInstant="2015-09-01T14:34:11.911Z"
Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
>
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:uchicago.edu</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</saml2p:Status>
<saml2:Assertion ID="_19afe508db72fdbd7c1d68602c4bb526"
IssueInstant="2015-09-01T14:34:11.911Z"
Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>
<saml2:Issuer>urn:mace:incommon:uchicago.edu</saml2:Issuer>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
NameQualifier="urn:mace:incommon:uchicago.edu"
SPNameQualifier="google.com"
>davel</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="128.135.108.28"
InResponseTo="joocmikcnkcejkmkikpncfpdgdopdkaifmnnaggg"
NotOnOrAfter="2015-09-01T14:39:11.914Z"
Recipient="https://www.google.com/a/uchicago.edu/acs"
/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2015-09-01T14:34:11.911Z"
NotOnOrAfter="2015-09-01T14:39:11.911Z"
>
<saml2:AudienceRestriction>
<saml2:Audience>google.com</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2015-09-01T14:34:11.897Z"
SessionIndex="_6f7dc0c39c817f00a861ff1ba42200bf"
>
<saml2:SubjectLocality Address="128.135.108.28" />
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>
</saml2p:Response>
> On Sep 1, 2015, at 5:11 AM, Dave Perry <Dave.Perry at hull-college.ac.uk> wrote:
>
> Ah right, I understand.
> Context checking removed, I now have the email address going off to google via the mail attribute (I gave up with the dedicated attribute thing).
> I did have to leave the changes you made to saml-nameid in though.
>
>
> But, google claims it cannot process the login request (certificates snipped out):
>
> <saml2:Assertion ID="_629babeb23cf5212ddf44fed3dbe9a96"
> IssueInstant="2015-09-01T10:29:52.726Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
> <saml2:Issuer>https://shibb.hull-college.ac.uk/idp/shibboleth</saml2:Issuer>
> <saml2:Subject>
> <saml2:NameID
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
> NameQualifier="https://shibb.hull-college.ac.uk/idp/shibboleth" SPNameQualifier="google.com">Dave.Perry at hull-college.ac.uk</saml2:NameID>
> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
> <saml2:SubjectConfirmationData Address="10.3.1.87"
> InResponseTo="eoikjlpfaenclpjacoaicalfpbobinkmhlkifpnc"
> NotOnOrAfter="2015-09-01T10:34:52.846Z" Recipient="https://www.google.com/a/hull-college.ac.uk/acs"/>
> </saml2:SubjectConfirmation>
> </saml2:Subject>
> <saml2:Conditions NotBefore="2015-09-01T10:29:52.726Z" NotOnOrAfter="2015-09-01T10:34:52.726Z">
> <saml2:AudienceRestriction>
> <saml2:Audience>google.com</saml2:Audience>
> </saml2:AudienceRestriction>
> </saml2:Conditions>
> <saml2:AuthnStatement AuthnInstant="2015-09-01T09:53:22.094Z" SessionIndex="_b78e48812b6ac1391c1bb9e7ae6606ab">
> <saml2:SubjectLocality Address="10.3.1.87"/>
> <saml2:AuthnContext>
> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
> </saml2:AuthnContext>
> </saml2:AuthnStatement>
> </saml2:Assertion>
>
> How does that compare to one of your working ones?
>
>
> Dave
> _________________________________________________
> Dave Perry
> eLearning Technologist, Hull College Group
>
> Room L34 - Queens Gardens Library
> Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG Extension 2230 /
> Direct Dial 01482 381930
>
> * Need a fast reply? Try elearning at hull-college.ac.uk *
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of David
> Langenberg
> Sent: 28 August 2015 15:37
> To: Shib Users
> Subject: Re: Google Apps with IdP v3 not working
>
>
>> On Aug 28, 2015, at 8:35 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> On 8/28/15, 10:29 AM, "users on behalf of Dave Perry" <users-bounces at shibboleth.net on behalf of Dave.Perry at hull-college.ac.uk> wrote:
>>
>>> I haven't modified any context flows, it should just be the stock one that came with v3 installer (I didn't do an automated upgrade).
>>
>> The event in the log is what the context-check intercept flow uses to block issuing a response. That isn't configured out of the box.
>
> You may want to remote that context-check from your config if you copied my stuff directly. We have a bit more going on behind the scenes (https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829) for which that context-check is being used.
>
> Dave
>
> --
> David Langenberg
> Identity & Access Management Architect The University of Chicago
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> **********************************************************************
> This message is sent in confidence for the addressee only. It may
> contain confidential or sensitive information. The contents are not
> to be disclosed to anyone other than the addressee. Unauthorised
> recipients are requested to preserve this confidentiality and to
> advise us of any errors in transmission. Any views expressed in this
> message are solely the views of the individual and do not represent
> the views of the College. Nothing in this message should be construed
> as creating a contract.
>
> Hull College Group owns the email infrastructure, including the contents.
>
> Hull College Group is committed to sustainability, please reflect before printing this email.
> **********************************************************************
>
> TEXT
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
--
David Langenberg
Identity & Access Management Architect
The University of Chicago
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list