Idp3 + GAFE

[Andrew Morgan]

On Thu, 9 Jun 2016, Jukka Hakosalo wrote:

> Hi,
>
> We have an Idp3. It's working mostly fine. There are problems with Google's
> GAFE.
>
> In relying-party.xml we have:
> ----------------------------
>        <bean parent="RelyingPartyByName"
> c:relyingPartyIds="google.com">
>
>            <property
> name="profileConfigurations">
>
> <list>
>                    <bean parent="SAML2.SSO"
>
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
>
>                         p:encryptAssertions="false" />
>                         p:postAuthenticationFlows="#{ {'context-check'}
> }"/>
>                </list>
>            </property>
>        </bean>
> -------------------------
>
> Attribute-filter and attribute-resolver are similar to old idp2. GAFE
> worked before.
>
> After login GAFE says:
> -----------------------
> This account cannot be accessed because we could not parse the login
> request.
>
>
> idp-process.log:
> -----------------------------------
> WARN
> [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:75]
> - Ignoring NameIDFormat metadata that includes the 'unspecified' format
>
> Where should I start to find the solution?

unspecified won't work, because it is unspecified! :)

Here is my Google config:

relying-party.xml:

         <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'google.com/a/oregonstate.edu'}}">
             <property name="profileConfigurations">
                 <list>
                     <bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptNameIDs="false" />
                 </list>
             </property>
         </bean>


saml-nameid.xml:

         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
             p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }">
             <property name="activationCondition">
                 <bean parent="shibboleth.Conditions.NOT">
                     <constructor-arg>
                         <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="google.com/a/oregonstate.edu" />
                     </constructor-arg>
                 </bean>
             </property>
         </bean>

         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
             p:attributeSourceIds="#{ {'google-principal'} }">
             <property name="activationCondition">
                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="google.com/a/oregonstate.edu" />
             </property>
         </bean>


attribute-resolver.xml:

     <!-- Google oregonstate.edu NameID attribute -->
     <resolver:AttributeDefinition xsi:type="ad:Simple" id="google-principal" sourceAttributeID="googlePrincipalName">
         <resolver:Dependency ref="ONIDLDAP" />
     </resolver:AttributeDefinition>


attribute-filter.xml:

     <!-- Google oregonstate.edu principal -->
     <AttributeFilterPolicy id="google-orst-principal">
         <PolicyRequirementRule xsi:type="Requester" value="google.com/a/oregonstate.edu" />
         <AttributeRule attributeID="google-principal">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>


metadata/google-orst.xml:

<EntityDescriptor entityID="google.com/a/oregonstate.edu" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
         <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                 <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
                 <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.google.com/a/oregonstate.edu/acs" />
         </SPSSODescriptor>
</EntityDescriptor>


NOTES:

We store the google principle (username) in an LDAP attribute named 
googlePrincipalName.  It is released to Google as a NameID with format 
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", as specified in 
the metadata.  We only generate this NameID for google.

Let me know if you have any questions!

Thanks,
 	Andy