Box.com and Shibboleth

[Tom Scavo]

On Wed, Mar 2, 2016 at 12:20 PM, Chad Sutton <casutton at noctrl.edu> wrote:
>
> Perhaps I need to update
> https://spaces.internet2.edu/display/NetPlusIDG/BoxIDG#BoxIDG-ExampleConfigurationforSAMLImplementations
> with this information?

The shib wiki would probably be better:
https://wiki.shibboleth.net/confluence/x/BIFKAQ

That Shib3 page is kinda sparse at the moment. Hopefully it will fill
out as Shib3 becomes more widely deployed. The Shib2 version is very
handy: https://wiki.shibboleth.net/confluence/x/l4BC

Tom

PS. Unless someone objects, I'm going to change the name of the above
page from "Commercial/Vendor Integration" to something else. Special
characters in Confluence page names are troublesome.

> On 02/29/2016 09:25 AM, Chad Sutton wrote:
>>
>> I'm at my wit's end here. We have an existing Shib IDP that is working
>> with a number of other SP's. But we couldn't seem to get it working properly
>> with Box.com. I followed the wiki
>> https://spaces.internet2.edu/display/NetPlusIDG/BoxIDG.
>>
>> I'm fairly new to Shibboleth so bare with me. Everything looks like it is
>> working except when it comes to passing Box the eduPersonPrincipalName,
>> which is really all that Box requires. It doesn't pass anything to them.  I
>> noticed that the PasswordProtectedTransport in my logs never contains any
>> field names like it does for other SPs.
>>
>> I've have since created a test server so I can mess with XML files and
>> restart Tomcat as much as I want. I am getting the same thing on the test
>> box.
>>
>>
>> A snip from my idp-process.log
>>
>> 2016-02-29 08:38:38,745 - INFO
>> [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] -
>> RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and
>> headers []
>> 2016-02-29 08:39:59,781 - INFO [org.ldaptive.auth.Authenticator:259] -
>> Authentication succeeded for dn: cn=casutton,ou=Admstr,ou=Napvil,o=NCC
>> 2016-02-29 08:39:59,794 - INFO
>> [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139] -
>> Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'casutton'
>> succeeded
>> 2016-02-29 08:40:00,327 - ERROR
>> [net.shibboleth.idp.profile.impl.ResolveAttributes:240] - Profile Action
>> ResolveAttributes: Error resolving attributes: Invalid Attribute resolver
>> configuration
>> 2016-02-29 08:40:00,989 - WARN
>> [net.shibboleth.idp.consent.flow.ar.impl.AbstractAttributeReleaseAction:155]
>> - Profile Action PopulateAttributeReleaseContext: Unable to locate attribute
>> context
>> 2016-02-29 08:40:02,513 - INFO [Shibboleth-Audit.SSO:241] -
>> 20160229T144002Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|aTaVxkNsrMagR4Tsw3dkh5l-TGR|box.net|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://logintest.noctrl.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f3849b289760d44449f9bfe62d6f459e|casutton|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxxxKquNVPpR5LnofTIk0ea6li7WEdmUEbq73t1trVyy0qmhwrpQqqRs93c3KvN2CKOCYhfPgpkI+m6tk9A3s0lgwRsyjjyWfzgPj5TKvI|_12beaf680eaf737d7b4d9ef639e27a4f|
>>
>> I'm assuming that this is a problem with my attribute-filter.xml file?
>> Here is what I have added for Box, which is direct from the wiki page.
>>
>>   <AttributeFilterPolicy id="BoxSSO">
>>     <PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
>> value="https://services.box.com/sp"/>
>>     <AttributeRule attributeID="eduPersonPrincipalName">
>>       <PermitValueRule xsi:type="basic:ANY"/>
>>     </AttributeRule>
>>     <AttributeRule attributeID="sn">
>>       <PermitValueRule xsi:type="basic:ANY"/>
>>     </AttributeRule>
>>     <AttributeRule attributeID="givenName">
>>       <PermitValueRule xsi:type="basic:ANY"/>
>>     </AttributeRule>
>>   </AttributeFilterPolicy>
>>
>> Any ideas of where I need to focus to get this working? The Box folks
>> aren't much help. They expect everyone to figure this out for themselves,
>> which is fair I guess, but I imagine there are tons of EDUs that use
>> Shibboleth and Box. So I know this works. :)
>>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net