Define a relying party profile for AuthnRequestsSigned="true"

[Karla Borecky]

Well, this

p:attributeSourceIds="#{ {'uid', 'UDC_IDENTIFIER'} }"

was my attempt to get their preferred attribute name (UDC_IDENTIFIER)
encoded as a NameID. I guess I made this syntax up, though... O_o

I did try to humor their unspecified with this bit of configuration:

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://scroogle.com"
<https://scroogle.com/>>
    <property name="profileConfigurations">
        <list>
            <bean parent="SAML2.SSO" p:encryptAssertions="false"

*p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
*
/>
        </list>
    </property>
</bean>

but I got errors. I should try it again, I guess.

It's not abundantly clear if they would just accept an attribute as the
login id (rather than a NameID proper) - which would be nice. But I'm
sending that out too, so...ugh. Dealing with SCT Banner/Ellucian/whoever
isn't the easiest.

Thank you, and Happy Friday -
Karla

On Thu, Mar 10, 2016 at 4:19 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Then I put this in saml-nameid.xml:
> >
> >      <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
> >             p:format="urn:oid:0.9.2342.19200300.100.1.1"
> >             p:attributeSourceIds="#{ {'uid', 'UDC_IDENTIFIER'} }" />
>
> Why two attributes as a source? Are there actually two?
>
> > The instructions for getting this thing talking to an external IdP aren't
> > abundantly clear, since they have their own IdP and have just started
> > supporting talking to someone else's. (In fact, their syntax for how to
> return
> > "UDC_IDENTIFIER" with another attribute as a source were just plain
> wrong.)
> > So if anyone has got this working - especially knowing what magic
> parameters
> > to use in the ssomanager configuration - I would appreciate your advice.
>
> Certainly it's possible they actually require "unspecified". I didn't say
> it would work, I just said it's worth trying to avoid it before falling
> back to that.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160311/2fb36a4a/attachment-0001.html>