Interop shibb SP - Google SAML IdP

[Rich Graves]

In case you hadn't heard, Google Apps is in the SAML IdP business now,
https://support.google.com/a/answer/6087519?hl=en

Observations:

- They spawn an entityID per customer of form
https://accounts.google.com/o/saml2?idpid=<random string>
- They supply metadata that works in the shib2 native SP.
- They can consume SP metadata from a form file submission or URL.
- For ACS, the HTTP-POST and HTTP-Redirect endpoints both work.
- Leave Start URL blank.
- As expected they send
 <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
- Standard Google user properties can be released as SAML 2.0 attributes:
givenname, surname, email, organizationalunit, job title, telephone if
Google knows it.
- The attribute and NameID formats are unspecified. The below
in attribute-map.xml "worked" for me. Please let me know if any of this is
wrong or insecure. They don't appear to scope email address in any way so
the recent Office 365 "SAML" vulnerability likely applies to sites that
trust the Google IdP.
    <Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
id="google-id">
        <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$Name" defaultQualifiers="true"/>
    </Attribute>
    <Attribute name="googleSurname"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
id="googleSurname"/>
- User experience is transparent. If user is signed on, they go straight
through. If they aren't, they get the standard accounts.google.com including
ability to choose among multiple simultaneously signed-on google accounts.
- Unlike OAuth2, the user is *not* prompted to authorize the app. It is
automatically trusted to receive the attributes explicitly released by the
Google Apps administrator.
- Similarly, the SAML app does not appear in the myaccount.google.com list
of connected sites and you cannot revoke access.
- However, each SAML app does show up in the user hub, see wiki-carleton at
bottom right. This could be good or bad depending on the number and
sensitivity of apps. App access can be scoped to OUs, though.

[image: Inline image 1]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160629/e9e1dd5a/attachment.html>