box.com / IDP 3.x

[Powell, Alan]

We are testing box as an InCommon member. I can’t get authentication to work even though it appears I am doing the right thing. My preference is to make sure it works with IDP 3.x. Can anyone who is using box provide any insight, ideally with IDP 3.x?  Does anyone see anything wrong with what I am doing?

The examples I’ve encountered seem to just indicate you do the typical Shib thing of releasing attributes but don’t you need to have the email be in the SAML subject in addition? (ie xsi:type="enc:SAML2StringNameID"  xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
)



I have the following attribute defined (in addition to sn and giveName which are not shown).

 <resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mailLocalAddress" >
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"  xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:email"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"/>


I release this attribute and sn and givenName to box.

    <afp:AttributeFilterPolicy id="boxSP">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://services.box.com/sp" />
        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="sn">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="givenName">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>


To get the correct nameid format, to use SHA1 which seemingly is the the only thing that works and to prevent encryption I do this:

      <bean parent="RelyingPartyByName" c:relyingPartyIds="https://services.box.com/sp"<https://services.box.com/sp%22>>
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"  p:nameIDFormatPrecedence="#{{ 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' }}" p:securityConfiguration-ref="SHA1SecurityConfig" p:encryptAssertions="false" p:encryptAttributes="false" p:encryptNameIDs="false" p:signResponses="true" p:signAssertions="false" />
                </list>
            </property>
        </bean>
    </util:list>


I am using their metadata from the InCommon metadata (the metadata on their site still uses box.net, the metadata in InCommon shows https://services.box.com/sp as the entityid)


I get a SAML AuthnRequest

<<?xml version="1.0" encoding="UTF-8"?>
<samlp:AuthnRequest ID="LM9BcupF8DmThyhXYeiHWfg-kVo"
    IssueInstant="2016-06-07T20:10:22.364Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://services.box.com/sp</saml:Issuer><https://services.box.com/sp%3C/saml:Issuer%3E>
    <samlp:NameIDPolicy AllowCreate="true"/>
</samlp:AuthnRequest>


I return a SAML assertion with an email in the subject and three attributes

        <saml2:Subject>
            <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">powela at rpi.edu<mailto:powela at rpi.edu></saml2:NameID>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="128.113.124.189"
                                               InResponseTo="LM9BcupF8DmThyhXYeiHWfg-kVo"
                                               NotOnOrAfter="2016-06-07T20:15:34.386Z"
                                               Recipient="https://sso.services.box.net/sp/ACS.saml2"
                                               />
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:AttributeStatement>
            <saml2:Attribute FriendlyName="mail"
                             Name="urn:oid:0.9.2342.19200300.100.1.3"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xsd:string"
                                      >powela at rpi.edu<mailto:powela at rpi.edu></saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute FriendlyName="sn"
                             Name="urn:oid:2.5.4.4"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xsd:string"
                                      >Powell</saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute FriendlyName="givenName"
                             Name="urn:oid:2.5.4.42"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xsd:string"
                                      >Alan</saml2:AttributeValue>
            </saml2:Attribute>
        </saml2:AttributeStatement>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160608/1f22246d/attachment-0001.html>