Box.com and Shibboleth
Brent Putman
putmanb at georgetown.edu
Thu Mar 3 10:56:49 EST 2016
If you want an example of a working response to Box, here is the entire
AttributeStatement we send them:
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="mail"
Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
>
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>putmanb at georgetown.edu</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
So we're just sending a mail attribute and nothing else.
Curiously, I also noticed that we aren't sending any Subject/NameID value:
<saml2:Subject>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="XXX.XXX.XXX.XXX"
InResponseTo="OaIrsDhsp8UJ2cKbG3QNIx8-u8Z"
NotOnOrAfter="2016-03-03T15:52:55.581Z"
Recipient="https://sso.services.box.net/sp/ACS.saml2"
/>
</saml2:SubjectConfirmation>
</saml2:Subject>
I suspect that that may be unintentional on the part of our IdP guys,
but either way would suggest that Box doesn't care about NameID and all
they really need is a 'mail' attribute.
Fwiw, I checked and our setup is still using their 'box.net' entityID,
not the newer full URI one that someone mentioned.
--Brent
On 3/3/16 10:04 AM, Chad Sutton wrote:
> Another update. It seems that while mail is being passed, sn
> (urn:oid:2.5.4.4) and givenName (urn:oid:2.5.4.42) aren't being passed.
>
> While I've gotten two different answers from them on what they call
> "subject" (an earlier one that said they were using the ePPN
> "urn:oid:1.3.6.1.4.1.5923.1.1.1.6" which was obviously wrong), this
> is the latest info they have sent me.
>
> first_name urn:oid:2.5.4.42 (Assertion)
> subject urn:oid:1.3.6.1.4.1.5923.1.1.1.6 (Assertion)
> last_name urn:oid:2.5.4.4 (Assertion)
>
> As I'm still pretty new to all of this, it seems to me that as I have
> never referenced "subject" in my config as
> urn:oid:1.3.6.1.4.1.5923.1.1.1.6 that because I've assigned that to
> the mail attributeID that it doesn't matter what the "friendly name"
> of the attributeID is and that only the urn code is what is being
> used. As I'm using the correct codes for "sn" and "givenName"
> shouldn't they be passing too?
>
> I feel like the crossed wires are on their end and not mine, but
> being so new to this I'm not super confident about that yet.
>
> Are these the same AttributeDefinitions others are using for Box?
>
>
> Regards,
> Chad Sutton - North Central College ITS
> casutton at noctrl.edu
> 630-637-5448
>
> On 02/29/2016 09:25 AM, Chad Sutton wrote:
>> I'm at my wit's end here. We have an existing Shib IDP that is
>> working with a number of other SP's. But we couldn't seem to get it
>> working properly with Box.com. I followed the wiki
>> https://spaces.internet2.edu/display/NetPlusIDG/BoxIDG.
>>
>> I'm fairly new to Shibboleth so bare with me. Everything looks like
>> it is working except when it comes to passing Box the
>> eduPersonPrincipalName, which is really all that Box requires. It
>> doesn't pass anything to them. I noticed that the
>> PasswordProtectedTransport in my logs never contains any field names
>> like it does for other SPs.
>>
>> I've have since created a test server so I can mess with XML files
>> and restart Tomcat as much as I want. I am getting the same thing on
>> the test box.
>>
>>
>> A snip from my idp-process.log
>>
>> 2016-02-29 08:38:38,745 - INFO
>> [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] -
>> RemoteUserAuthServlet will process REMOTE_USER, along with
>> attributes [] and headers []
>> 2016-02-29 08:39:59,781 - INFO [org.ldaptive.auth.Authenticator:259]
>> - Authentication succeeded for dn:
>> cn=casutton,ou=Admstr,ou=Napvil,o=NCC
>> 2016-02-29 08:39:59,794 - INFO
>> [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139]
>> - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
>> 'casutton' succeeded
>> 2016-02-29 08:40:00,327 - ERROR
>> [net.shibboleth.idp.profile.impl.ResolveAttributes:240] - Profile
>> Action ResolveAttributes: Error resolving attributes: Invalid
>> Attribute resolver configuration
>> 2016-02-29 08:40:00,989 - WARN
>> [net.shibboleth.idp.consent.flow.ar.impl.AbstractAttributeReleaseAction:155]
>> - Profile Action PopulateAttributeReleaseContext: Unable to locate
>> attribute context
>> 2016-02-29 08:40:02,513 - INFO [Shibboleth-Audit.SSO:241] -
>> 20160229T144002Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|aTaVxkNsrMagR4Tsw3dkh5l-TGR|box.net|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://logintest.noctrl.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f3849b289760d44449f9bfe62d6f459e|casutton|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxxxKquNVPpR5LnofTIk0ea6li7WEdmUEbq73t1trVyy0qmhwrpQqqRs93c3KvN2CKOCYhfPgpkI+m6tk9A3s0lgwRsyjjyWfzgPj5TKvI|_12beaf680eaf737d7b4d9ef639e27a4f|
>>
>> I'm assuming that this is a problem with my attribute-filter.xml
>> file? Here is what I have added for Box, which is direct from the
>> wiki page.
>>
>> <AttributeFilterPolicy id="BoxSSO">
>> <PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
>> value="https://services.box.com/sp"/>
>> <AttributeRule attributeID="eduPersonPrincipalName">
>> <PermitValueRule xsi:type="basic:ANY"/>
>> </AttributeRule>
>> <AttributeRule attributeID="sn">
>> <PermitValueRule xsi:type="basic:ANY"/>
>> </AttributeRule>
>> <AttributeRule attributeID="givenName">
>> <PermitValueRule xsi:type="basic:ANY"/>
>> </AttributeRule>
>> </AttributeFilterPolicy>
>>
>> Any ideas of where I need to focus to get this working? The Box
>> folks aren't much help. They expect everyone to figure this out for
>> themselves, which is fair I guess, but I imagine there are tons of
>> EDUs that use Shibboleth and Box. So I know this works. :)
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160303/cb024faa/attachment.html>
More information about the users
mailing list