Blackboard Transact and IdP 3

[Michael A Grady]

No, Transact did not require EPPN in the Subject, it worked fine, at least with IdPv2, with Transient or CryptoTransient as the NameId. Some things about Transact that have been sent to this list before:

 - has no allowance/capability for checking the front-channel signature, which is why it "ignores" any and all attributes sent that way,
 - only cares about the FriendlyName for attributes, ignores the actual name,
 - always does the back-channel attribute query, because that's the only way it has "security" around the attributes it receives

I got a site working with v2 using Scott's added CryptoTransient support for v2. But it was trial and error, as one gets no feedback from the other side. Most frustrating integration I can recall.

Presumably it works with v3 with the default Transient which is essentially equivalent to the crypto-transient for v2.

> On May 24, 2016, at 12:28 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
> 
> Here's my working v2 relying party config for Transact:
> <!-- BlackBoard Transact does not support encryption; uses AttributeQuery 2014-10-23 -->
>    <RelyingParty id="https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt <https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt>"
>        provider="urn:mace:incommon:alaska.edu <http://alaska.edu/>"
>        defaultSigningCredentialRef="IdPCredential"
>        defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
>        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
>        <ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" encryptAssertions="never" encryptNameIds="never" />
>    </RelyingParty>
> Additional unique aspects of the Transact SP are:
> <!-- Bb Transact require something like ePPN in the SAML Subject -->
> <!-- Bb Transact requires its own unique FriendlyNames so add definitions and encoders with those FriendlyNames -->
> David Bantz
> UAlaska
> 
> On Tue, May 24, 2016 at 8:24 AM, Peter Schober <peter.schober at univie.ac.at <mailto:peter.schober at univie.ac.at>> wrote:
> * James McCartin <jmccartin at loyola.edu <mailto:jmccartin at loyola.edu>> [2016-05-24 17:56]:
> > The SP does ignore the attributes sent in the HTTP POST and then
> > queries the IdP.  What can I look at to confirm that my v3 IdP
> > supports this type of attribute query?
> 
> The documentation? I have no idea how you deployed your IDP, how you
> decided supported SOAP queries, on what port, involving what
> containers, etc.
> 
> Assuming for now you have properly configured SOAP support, I'd start
> with making sure the port you publish for your IDP's
> AttributeAuthority endpoints is open on the firewall.
> I.e., if https://shibprodapp.loyola.edu/idp/shibboleth <https://shibprodapp.loyola.edu/idp/shibboleth> is your IDP
> make sure that https://shibprodapp.loyola.edu:8443/ <https://shibprodapp.loyola.edu:8443/> can be reached
> from the outside world -- it currently isn't.
> 
> If in doubt look at the SAML Metadata the SP in question has about
> your IDP, and make sure the endpoints puiblished there are reachable.
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160524/0189dc68/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160524/0189dc68/attachment.sig>