WORKPLACE BY FACEBOOK integration

[Matt Brennan]

It took me some playing to get it to work. They don't appear to sign their
requests. They also do not provision from a valid SAML authentication. They
do have an SCIM API though. Their authentication documentation is located
at https://developers.facebook.com/docs/workplace/authentication/sso

This is what I ended up with, for metadata -- I edited it to have your
endpoint information:

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor ID="FBatWork" entityID="
https://www.facebook.com/company/1077798945674112"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://alaska.facebook.com/work/saml.php" index="0" isDefault="true"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>

For attributes, they only accept e-mail (as Name ID).

HTH,
-Matt


On Wed, Nov 2, 2016 at 7:26 PM, IAM David Bantz <dabantz at alaska.edu> wrote:

> I was provided:
>
> Audience URL https://www.facebook.com/company/1077798945674112
>
> Recipient URL https://alaska.facebook.com/work/saml.php
>
> ACS (Assertion Consumer Service) URL https://alaska.facebook.
> com/work/saml.php
>
> I'm guessing Recipient is entityID
>
> db
>
> On Wed, Nov 2, 2016 at 3:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> > WORKPLACE BY FACEBOOK apparently deploys simpleSAML PHP / SAML 2.0
>> > for SSO but provides minimal documentation. No metadata or certificate,
>> no
>> > attribute requirements, etc.
>>
>> The bare minimum is the endpoint, if the implementation is broken and
>> doesn't check Audience conditions. That's not per se a security hole unless
>> they also don't check the Recipient attribute, but that takes some
>> dedicated pen-testing to determine. I have done integrations that did not
>> have an entityID and worked like that, though after reporting it I was able
>> to get them to configure one (in their view, the audience to check for).
>>
>> When in doubt, stick whatever the user identifier has to be in the NameID
>> and see if it works, assuming you know the endpoint to create the metadata
>> around.
>>
>> It is less work to just experiment, which takes a few minutes, than worry
>> about getting all the details right.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161102/f2ad9615/attachment.html>