google apps integration problem

[Janemarie Duh]

Dave (and Mark),

It would be beneficial to the wider higher ed community if you would
contribute to the (currently incomplete) Google Apps integration doc at
https://wiki.shibboleth.net/confluence/display/IDP30/Google+Apps+for+Education

FYI, the integration doc landing page is at
https://wiki.shibboleth.net/confluence/display/IDP30/IntegrationGuides
and contains a template for new services.


                 Janemarie

         

 


On 11/28/16 9:52 AM, Dave Perry wrote:
>
> Having done this recently…
>
>  
>
> Check in your google apps admin account Security > SSO options, if you
> have enabled a tickbox called something like ‘issue domain-specific
> identifier’. I think from that error, you have.
>
>  
>
> You need to setup the relying party config to match that. Here is ours
> (until /<util:list id="shibboleth.RelyingPartyOverrides">/ ):
>
> /                                <bean parent="RelyingPartyByName"
> c:relyingPartyIds="#{{'google.com'}}">/
>
> /            <property name="profileConfigurations">/
>
> /                <list>/
>
> /                        <bean parent="SAML2.SSO"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
> p:encryptAssertions="false" />/
>
> /                </list>/
>
> /            </property>/
>
> /        </bean>/
>
> Change the ‘google.com’ to match yours.
>
>  
>
> I will update the wiki with my experiences when I get a chance (will
> try this week, been meaning to since I figured it all out a few weeks
> back).
>
>  
>
> HTH,
>
> Dave
>
> _________________________________________________
>
> Dave Perry
> eLearning Technologist, Hull College Group *(Monday – Thursday)*
>
> Room L34 - Queens Gardens Library
> Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
> Extension 2230 / Direct Dial 01482 381930
>
>  
>
> ** Need a fast reply? Try elearning at hull-college.ac.uk
> <mailto:elearning at hull-college.ac.uk> **
>
>  
>
> *From:*users [mailto:users-bounces at shibboleth.net] *On Behalf Of *Mark
> Nesterovych
> *Sent:* 28 November 2016 14:47
> *To:* users at shibboleth.net
> *Subject:* google apps integration problem
>
>  
>
> Hello.
>
> I am using shibboleth 3.2.1
>
> There are a lot of articles, describing parts of configuration, and I
> can not find any describing the whole process. If there is any one
> somewhere will be grateful for any links to such resources.
>
>  
>
> At the moment integration shows following errors:
>
> 2016-11-28 09:45:29,217 - DEBUG
> [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293]
> - Resolving re
>
> lying party configuration
>
> 2016-11-28 09:45:29,218 - DEBUG
> [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:305]
> - Checking if relying party configuration
> EntityNames[google.com/a/example.com,
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__google.com_a_example.com-2C&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=YDTG91zRRg4kdzy7phPHMj9V8dj14G1d0JC5UAM8NJA&e=>]
> is applicable
>
> 2016-11-28 09:45:29,218 - DEBUG
> [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:310]
> - Relying party configuration EntityNames[google.com/a/example.com,
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__google.com_a_example.com-2C&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=YDTG91zRRg4kdzy7phPHMj9V8dj14G1d0JC5UAM8NJA&e=>]
> is not applicable
>
>  
>
> Following part is from relaing-party.xml
>
>  
>
>     <util:list id="shibboleth.RelyingPartyOverrides">
>
>          <bean parent="RelyingPartyByName"
> c:relyingPartyIds="google.com/a/example.com
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__google.com_a_example.com&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=eyk6_AIG3WeDft5aIXu5EAMzlH23-TAF-u998N133LI&e=>">
>
>            <property name="profileConfigurations">
>
>                <list>
>
>                    <bean parent="SAML2.SSO"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:uns"
> p:encryptAssertions="false" />
>
>                </list>
>
>            </property>
>
>        </bean>
>
>  
>
>     </util:list>
>
>  
>
> Could somebody gave a glue what is wrong here,  and why such
> configuration is not applicable.
>
> Thank you.
>
>  
>
>  
>
> -- 
>
> Best regards,
>
> Mark Nesterovych
>
> Click here to view the College's range of publications celebrating
> staff and student successes
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.hull-2Dcollege.ac.uk_publications&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=oznUs_yi67hXwUR12BRLXjxUGPYFzzesq_aJ2R-t7uU&e=> 
>
> This message is sent in confidence for the addressee  only.  It may
> contain confidential or sensitive  information.  The contents are not
> to be disclosed  to anyone other than the addressee.  Unauthorised 
> recipients are requested to preserve this  confidentiality and to
> advise us of any errors in  transmission.  Any views expressed in this
> message  are solely the views of the individual and do not  represent
> the views of the College.  Nothing in this  message should be
> construed as creating a contract.
>
> Hull College Group owns the email infrastructure, including the contents.
>
> Hull College Group is committed to sustainability, please reflect
> before printing this email.
> ------------------------------------------------------------------------
>
>

-- 
Janemarie Duh
Lafayette College
Identity Management Systems Architect
Information Technology Services

Buddhist Religious Advisor
Office of Religious and Spiritual Life

610-330-5609

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161128/e9de161c/attachment-0001.html>