Docusign [IdP configuration Solved]

[Cantor, Scott]

On 12/7/16, 3:37 PM, "users on behalf of Dr_Natas" <users-bounces at shibboleth.net on behalf of Juan.Rios at csuci.edu> wrote:

>    In hopes that this will save some time for someone in the future, and hope
>    they learn from my mistakes.

I don't know what you think they were, but what you posted contains a lot of mistakes. Some very major ones.

It's also clear Docusign has many different integration strategies that have very different requirements so there's hardly one size fits all here.

>    "metadata-providers.xml"

It is a mistake to load unsigned metadata from a remote source. At the very least, if you do it, you'd better damn well whitelist the entityID you expect to get from it.

> "saml-nameid.xml"

Pick one: filter the source attribute or filter the NameID generator. You don't need to limit both using two identical conditions/rules.

> "attribute-resolover.xml"
 
Again, pick one. Either use the resolver to encode an AttributeDefinition to a NameID (though that's a deprecated approach) or use a NameID generator. This is just completely wrong as is, because the attribute here is NOT a persistent ID itself, it's a seed for a hash to get one. The reason it's not blowing it all up is that you probably have the legacy NameID generation turned off so it's ignoring that AttributeEncoder and using the generator instead. 

-- Scott