SP certificate expiration

[Andrew Morgan]

On Wed, 27 Apr 2016, Losen, Stephen C. (scl) wrote:

> Hi Andy,
>
> Would you be willing to share with me your Salesforce SP setup?  I admin 
> the Shibboleth IDP here and a department is trying to set up SAML on 
> their Salesforce instance using the web tool. They keep sending me 
> screen shots asking me what to do and I have offered some suggestions, 
> but we can't get it working.  We get past the Shib IDP login, but the 
> username is not being recognized by the SP.  We are sending eppn as an 
> attribute using the "urn:oid..." style name.  I don't have access to the 
> web tool (I'm not the Salesforce customer).  If you have something 
> working could you describe what you did, or send me a screen shot.  My 
> email addr is below, to avoid cluttering this mailing list.

Sure, here is our configuration in a sandbox Salesforce instance.  See the 
attached screenshot.

On the IDP side, we are releasing EPPN to Salesforce, and I have disabled 
encryption for them in relying-party.xml:

   <bean parent="RelyingPartyByName"c:relyingPartyIds="#{{'https://saml.salesforce.com'}}">
       <property name="profileConfigurations">
           <list>
               <bean parent="SAML2.SSO" p:encryptAssertions="false"p:encryptNameIDs="false" />
           </list>
       </property>
   </bean>


 	Andy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: salesforce-saml.jpg
Type: image/jpeg
Size: 29091 bytes
Desc: 
URL: <http://shibboleth.net/pipermail/users/attachments/20160427/e9a94668/attachment-0001.jpg>