Blackboard Transact & IDP 3.x

[Michael A Grady]

> On Mar 28, 2016, at 3:49 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
>> Ok, good to know. I really don’t know how they’re differentiating between
>> IdP 2 and 3, or what their actual requirements are. Based on this thread, I’m
>> hoping someone else has some experience with what exactly is needed to
>> get Bb Transact working, as they don’t seem to know much themselves.
> 
> My point is that of the three possible issues, two of them are trivial for anybody to test out. The third means they have a bug and there's nothing you can do to fix it. Nailing down which of those is involved is not really something you need them to do.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

Unless Blackboard Transact has changed something since I helped an institution integrate with them in fall of 2014 (one would hope they have evolved their SAML implementation), the following were true then:

 - their requirements involved having to match the actual FriendlyName to their needs, they did not use the real on-the-wire attribute names

 - they don't take your IdP's certificate, which means they can't verify the signature on the response, and thus there is *no* security on the SAMLv2 response you send them. Which is also why (one surmises) they only accepted a Transient or CryptoTransient NameID.

 - so even if you send a bunch of attributes on the front-channel, they *will* send a backchannel Attribute Query, because the TLS verification there is the thing that provides security around your "SAML interaction" with them

 - the cert you present for the backchannel needs to have in it the name under which they are accessing the server. I don't think it needs to be a CA-issued cert, but I don't recall what we ended up having actually working. It took a number of tries, and there is no access to any logs on their (Blackboard's side) as to what is happening on their end.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160328/4231790f/attachment.sig>