Novell/NetIQ IDM and Shibboleth

[Schwoerer, Brad]

I had it working for IDM 4.5.2 and Shibboleth IdP v3.  I had first messed this up when moving to Shib IdP v3 as I had missed that the assertion was signed and not the SAML2Response.   I had commented on the bottom of the blog post here https://www.netiq.com/communities/cool-solutions/configuring-idm-4-5s-osp-talk-shibboleth-idp/ and stated how I got it working as well.

The issue is that they made some significant changes with IDM 4.5.3 and moved to OSP 6.0.0 from OSP 5.x.  I created a NetIQ forum post on the issue and it can be read here: https://forums.netiq.com/showthread.php?55302-Non-NAM-SAML-IDP-and-OSP-6-0

To summarize the issue, they extract the SAML Assertion and incorrectly try to clean namespace declarations on the signed assertion after it was initially verified.  They used this extracted SAML Assertion later in the process and it no longer verifies because of the changes to the Assertion.


-Bradley


From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of David Gersic <dgersic at niu.edu<mailto:dgersic at niu.edu>>
Reply-To: Users Shib <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Tuesday, February 16, 2016 at 8:20 AM
To: Users Shib <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Novell/NetIQ IDM and Shibboleth


Asking some friends, I'm told that this does work, or at least can be made to work, with IdP v3. I'm still acquiring the details as to what needs to be done, though.


________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Liam Hoekenga <liamr at umich.edu<mailto:liamr at umich.edu>>
Sent: Monday, February 15, 2016 9:40 AM
To: Shib Users
Subject: Re: Novell/NetIQ IDM and Shibboleth


On Mon, Feb 15, 2016 at 10:24 AM, David Gersic <dgersic at niu.edu<mailto:dgersic at niu.edu>> wrote:

NIU is a long time user of MicroFocus (was NetIQ, was Novell) eDirectory and Identity Manager. We're also using Shibboleth here. They go quite well together, IMHO. We aren't using OSP here, but a friend has written an article on how to get OSP to work with Shibboleth (https://www.netiq.com/communities/cool-solutions/configuring-idm-4-5s-osp-talk-shibboleth-idp/), so maybe that's an option for you.

I was talking to Brad about this off-list, and apparently there's a change between the OSP in 4.5.2 and 4.5.3 that breaks things:

    From 4.5 through 4.5.2 Shibboleth IDP worked by virtue of the SAML2 support, but in 4.5.3 it breaks
    from a bug.  Since NAM is their only supported IDP, and the bugI found is not a problem in NAM, but
    it is a problem with Shibboleth, they are not considering it a bug that needs to be fixed.

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160216/26756085/attachment.html>