google apps integration problem

Mon Nov 28 11:04:18 EST 2016

I am happy to add what I found worked, then others who are more qualified can chime in / alter anything which is un-necessary (e.g. Scott saying early that something I had done shouldn't be necessary).

Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group (Monday - Thursday)

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Janemarie Duh
Sent: 28 November 2016 16:03
To: Shib Users
Subject: Re: google apps integration problem

Dave (and Mark),

It would be beneficial to the wider higher ed community if you would contribute to the (currently incomplete) Google Apps integration doc at https://wiki.shibboleth.net/confluence/display/IDP30/Google+Apps+for+Education

FYI, the integration doc landing page is at https://wiki.shibboleth.net/confluence/display/IDP30/IntegrationGuides and contains a template for new services.

                 Janemarie

On 11/28/16 9:52 AM, Dave Perry wrote:
Having done this recently...

Check in your google apps admin account Security > SSO options, if you have enabled a tickbox called something like 'issue domain-specific identifier'. I think from that error, you have.

You need to setup the relying party config to match that. Here is ours (until <util:list id="shibboleth.RelyingPartyOverrides"> ):
                                <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'google.com'}}">
            <property name="profileConfigurations">
                <list>
                        <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>
Change the 'google.com' to match yours.

I will update the wiki with my experiences when I get a chance (will try this week, been meaning to since I figured it all out a few weeks back).

HTH,
Dave
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group (Monday - Thursday)

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Mark Nesterovych
Sent: 28 November 2016 14:47
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: google apps integration problem

Hello.
I am using shibboleth 3.2.1
There are a lot of articles, describing parts of configuration, and I can not find any describing the whole process. If there is any one somewhere will be grateful for any links to such resources.

At the moment integration shows following errors:
2016-11-28 09:45:29,217 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293] - Resolving re
lying party configuration
2016-11-28 09:45:29,218 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:305] - Checking if relying party configuration EntityNames[google.com/a/example.com,<https://urldefense.proofpoint.com/v2/url?u=http-3A__google.com_a_example.com-2C&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=YDTG91zRRg4kdzy7phPHMj9V8dj14G1d0JC5UAM8NJA&e=>] is applicable
2016-11-28 09:45:29,218 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:310] - Relying party configuration EntityNames[google.com/a/example.com,<https://urldefense.proofpoint.com/v2/url?u=http-3A__google.com_a_example.com-2C&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=YDTG91zRRg4kdzy7phPHMj9V8dj14G1d0JC5UAM8NJA&e=>] is not applicable

Following part is from relaing-party.xml

    <util:list id="shibboleth.RelyingPartyOverrides">
         <bean parent="RelyingPartyByName" c:relyingPartyIds="google.com/a/example.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__google.com_a_example.com&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=eyk6_AIG3WeDft5aIXu5EAMzlH23-TAF-u998N133LI&e=>">
           <property name="profileConfigurations">
               <list>
                   <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:uns" p:encryptAssertions="false" />
               </list>
           </property>
       </bean>

    </util:list>

Could somebody gave a glue what is wrong here,  and why such configuration is not applicable.
Thank you.

--
Best regards,
Mark Nesterovych
Click here to view the College's range of publications celebrating staff and student successes<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.hull-2Dcollege.ac.uk_publications&d=CwMGaQ&c=R_4lvufQDu25rflw2-oxk1ta8gMshLx4NEAyywNmS2w&r=LrwNN1Hg97KaEENv5GezQOrhPrdrpo9DJkWJE9HzPtg&m=ZhWVwy6xewTzu6kuoiqq2bnumHzF3xyjoqRaawcszq4&s=oznUs_yi67hXwUR12BRLXjxUGPYFzzesq_aJ2R-t7uU&e=>

This message is sent in confidence for the addressee  only.  It may contain confidential or sensitive  information.  The contents are not to be disclosed  to anyone other than the addressee.  Unauthorised  recipients are requested to preserve this  confidentiality and to advise us of any errors in  transmission.  Any views expressed in this message  are solely the views of the individual and do not  represent the views of the College.  Nothing in this  message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
________________________________

--

Janemarie Duh

Lafayette College

Identity Management Systems Architect

Information Technology Services

Buddhist Religious Advisor

Office of Religious and Spiritual Life

610-330-5609
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161128/29ccfcb6/attachment-0001.html>