WORKPLACE BY FACEBOOK integration

[IAM David Bantz]

Very helpful Matt - thank you!

David Bantz

On Wed, Nov 2, 2016 at 3:39 PM, Matt Brennan <brennanma at gmail.com> wrote:

> It took me some playing to get it to work. They don't appear to sign their
> requests. They also do not provision from a valid SAML authentication. They
> do have an SCIM API though. Their authentication documentation is located
> at https://developers.facebook.com/docs/workplace/authentication/sso
>
> This is what I ended up with, for metadata -- I edited it to have your
> endpoint information:
>
> <?xml version="1.0" encoding="UTF-8"?>
> <md:EntityDescriptor ID="FBatWork" entityID="https://www.
> facebook.com/company/1077798945674112" xmlns:md="urn:oasis:names:tc:
> SAML:2.0:metadata">
> <md:SPSSODescriptor AuthnRequestsSigned="false"
> WantAssertionsSigned="true" protocolSupportEnumeration="
> urn:oasis:names:tc:SAML:2.0:protocol">
> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-
> format:emailAddress</md:NameIDFormat>
> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> Location="https://alaska.facebook.com/work/saml.php" index="0"
> isDefault="true"/>
> </md:SPSSODescriptor>
> </md:EntityDescriptor>
>
> For attributes, they only accept e-mail (as Name ID).
>
> HTH,
> -Matt
>
>
> On Wed, Nov 2, 2016 at 7:26 PM, IAM David Bantz <dabantz at alaska.edu>
> wrote:
>
>> I was provided:
>>
>> Audience URL https://www.facebook.com/company/1077798945674112
>>
>> Recipient URL https://alaska.facebook.com/work/saml.php
>>
>> ACS (Assertion Consumer Service) URL https://alaska.facebook.co
>> m/work/saml.php
>>
>> I'm guessing Recipient is entityID
>>
>> db
>>
>> On Wed, Nov 2, 2016 at 3:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>>> > WORKPLACE BY FACEBOOK apparently deploys simpleSAML PHP / SAML 2.0
>>> > for SSO but provides minimal documentation. No metadata or
>>> certificate, no
>>> > attribute requirements, etc.
>>>
>>> The bare minimum is the endpoint, if the implementation is broken and
>>> doesn't check Audience conditions. That's not per se a security hole unless
>>> they also don't check the Recipient attribute, but that takes some
>>> dedicated pen-testing to determine. I have done integrations that did not
>>> have an entityID and worked like that, though after reporting it I was able
>>> to get them to configure one (in their view, the audience to check for).
>>>
>>> When in doubt, stick whatever the user identifier has to be in the
>>> NameID and see if it works, assuming you know the endpoint to create the
>>> metadata around.
>>>
>>> It is less work to just experiment, which takes a few minutes, than
>>> worry about getting all the details right.
>>>
>>> -- Scott
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161102/f062d84c/attachment-0001.html>