DocuSign SSO issues on Dev environment.
Andrew Morgan
morgan at orst.edu
Wed Nov 30 16:57:50 EST 2016
Wow, there is a lot going on there, but it's all too complicated.
Docusign requires a SAML Persistent NameID. That's not an attribute, so
the attribute resolver and filter don't really matter much.
1. Configure Shibboleth to generate a persistent NameID
a. In saml-nameid.xml, uncomment this:
<ref bean="shibboleth.SAML2PersistentGenerator" />
b. In saml-nameid.properties, configure related properties:
idp.persistentId.sourceAttribute = <your persistent attribute>
idp.persistentId.useUnfilteredAttributes = true
idp.persistentId.algorithm = SHA
idp.persistentId.salt = <random secret string here>
2. Turn off encryption for Docusign in relying-party.xml (use the
entityID for Docusign that they gave you):
<bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://account-d.docusign.com/organizations/0284fa80-8b6c-4bcf-b411-e997a4d705e9/saml2'}}">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptNameIDs="false" />
</list>
</property>
</bean>
3. Release email and name attributes using attribute-filter.xml
I hope this helps!
Andy
On Wed, 30 Nov 2016, Dr_Natas wrote:
> Hello everybody,
>
> One word "Docusign". I'm not able to get our idp to communicate with the SSO
> with DocuSign. See exhibit_A.png
> <http://shibboleth.1660669.n2.nabble.com/file/n7629901/Exhibit_A.png>
> Can someone take a look at my saml-nameid.xml to verify that it looks good.
>
>
>
> Haven't been able to get past this issue. The most relevant post the issue
> that I'm having is the following.
> http://shibboleth.1660669.n2.nabble.com/Docusign-td7627413.html#a7627415
> Alaska University discovered that Docusign forces you to disable encryption.
>
>
>
> Self Note: Debugging is on for my test environment. Revert back to Info
> only.
>
> Logs: idp-process.log
> Log Notes: I changed the user name we use for the test account to
> test-account at csuci.edu.
>
> tail -f /opt/shibboleth-idp/logs/idp-process.log |grep "Beginning to encode
> attribute" -B 5 -A 10
> 2016-11-30 11:55:36,955 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] -
> Finished creating instance of bean 'AddAttributeStatementToAssertion'
> 2016-11-30 11:55:36,955 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:49] - Executing
> net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion at 1d0bbabf
> 2016-11-30 11:55:36,956 - DEBUG
> [net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion:229]
> - Profile Action AddAttributeStatementToAssertion: Attempting to add an
> AttributeStatement to outgoing Assertion
> 2016-11-30 11:55:36,956 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute mail as a SAML 2 Attribute
> 2016-11-30 11:55:36,956 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:188]
> - Profile Action AddAttributeStatementToAssertion: Encoding attribute mail
> as a SAML 2 Attribute
> 2016-11-30 11:55:36,957 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:154]
> - Beginning to encode attribute mail
> 2016-11-30 11:55:36,957 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] -
> Encoding value test-account at csuci.com of attribute mail
> 2016-11-30 11:55:36,958 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191]
> - Completed encoding 1 values for attribute mail
> 2016-11-30 11:55:36,958 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute transientId as a SAML 2 Attribute
> 2016-11-30 11:55:36,958 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:204]
> - Profile Action AddAttributeStatementToAssertion: Attribute transientId did
> not have a usable SAML 2 Attribute encoder associated with it, nothing to do
> 2016-11-30 11:55:36,959 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute NameID as a SAML 2 Attribute
> 2016-11-30 11:55:36,959 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:204]
> - Profile Action AddAttributeStatementToAssertion: Attribute NameID did not
> have a usable SAML 2 Attribute encoder associated with it, nothing to do
> 2016-11-30 11:55:36,960 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute surname as a SAML 2 Attribute
> 2016-11-30 11:55:36,960 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:188]
> - Profile Action AddAttributeStatementToAssertion: Encoding attribute
> surname as a SAML 2 Attribute
> 2016-11-30 11:55:36,960 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:154]
> - Beginning to encode attribute surname
> 2016-11-30 11:55:36,961 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] -
> Encoding value test-account of attribute surname
> 2016-11-30 11:55:36,962 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191]
> - Completed encoding 1 values for attribute surname
> 2016-11-30 11:55:36,962 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute givenName as a SAML 2 Attribute
> 2016-11-30 11:55:36,962 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:188]
> - Profile Action AddAttributeStatementToAssertion: Encoding attribute
> givenName as a SAML 2 Attribute
> 2016-11-30 11:55:36,963 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:154]
> - Beginning to encode attribute givenName
> 2016-11-30 11:55:36,963 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] -
> Encoding value test-account of attribute givenName
> 2016-11-30 11:55:36,964 - DEBUG
> [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191]
> - Completed encoding 1 values for attribute givenName
> 2016-11-30 11:55:36,964 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:118]
> - Profile Action AddAttributeStatementToAssertion: Adding constructed
> AttributeStatement to Assertion _57eee162691461ac1f6ae8b64c5974b2
> 2016-11-30 11:55:36,964 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:53] - Finished
> executing
> net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion at 1d0bbabf;
> result = null
> 2016-11-30 11:55:36,965 - DEBUG
> [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing
> action execution attributes map[[empty]]
> 2016-11-30 11:55:36,965 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:53] - Finished
> executing [EvaluateAction at 728e5a48 expression =
> AddAttributeStatementToAssertion, resultExpression = [null]]; result = null
> 2016-11-30 11:55:36,966 - DEBUG
> [org.springframework.webflow.engine.ActionState:120] - Action execution [5]
> returned a [null] event: proceeding to the next action in the list
> 2016-11-30 11:55:36,966 - DEBUG
> [org.springframework.webflow.execution.ActionExecutor:49] - Executing
> [EvaluateAction at 15826934 expression = AddNameIDToSubjects, resultExpression
> = [null]]
> 2016-11-30 11:55:36,966 - DEBUG
> [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action
> execution attributes map[[empty]]
> 2016-11-30 11:55:36,967 - DEBUG
> [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] -
> Creating instance of bean 'AddNameIDToSubjects'
>
> The most relevant log notes that I can see are these two.
>
> 2016-11-30 11:55:36,959 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
> - Profile Action AddAttributeStatementToAssertion: Attempting to encode
> attribute NameID as a SAML 2 Attribute
> 2016-11-30 11:55:36,959 - DEBUG
> [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:204]
> - Profile Action AddAttributeStatementToAssertion: Attribute NameID did not
> have a usable SAML 2 Attribute encoder associated with it, nothing to do
>
> Some how I don't think my settings for my Attribute-Resolver.xml are up to
> par.
>
> Note: Truncated Attribute-Resolver.xml for Docusign
> 427
> 428 <resolver:AttributeDefinition xsi:type="ad:Simple" id="NameID"
> sourceAttributeID="employeeID">
> 429 <resolver:Dependency ref="myLDAP" />
> 430 <resolver:AttributeEncoder
> xsi:type="enc:SAML1StringNameIdentifier"
> nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
> 431 <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
> 432 </resolver:AttributeDefinition>
>
>
> More logs from "Idp-Process.log"
> 2016-11-30 12:45:47,454 - DEBUG [PROTOCOL_MESSAGE:70] -
> <?xml version="1.0" encoding="UTF-8"?>
> <saml2p:Response
>
> Destination="https://account-d.docusign.com/organizations/37269197-2dd0-49da-8668-526cfe2e4c56/saml2/login"
> ID="_bc2cea9fa2f2800a094b5fc486fd3f45"
> InResponseTo="_56cb71eb-4d64-4921-a0b1-fe7f14e3c0ae"
> IssueInstant="2016-11-30T20:45:47.099Z" Version="2.0"
> xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
> <saml2:Issuer
> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://209.129.116.15/idp/shibboleth</saml2:Issuer>
> <ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo>
> <ds:CanonicalizationMethod
> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
> <ds:SignatureMethod
>
> Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
> <ds:Reference
> URI="#_bc2cea9fa2f2800a094b5fc486fd3f45">
> <ds:Transforms>
> <ds:Transform
>
> Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
> <ds:Transform
> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
> </ds:Transforms>
> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
> <ds:DigestValue>G1R70Jwe7APsBp+Ag8mXYwYOvZrkkaC6Nr2o1TX5qp0=</ds:DigestValue>
> </ds:Reference>
> </ds:SignedInfo>
> <ds:SignatureValue>
> Truncate Cert
> </ds:SignatureValue>
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>Truncate Cert=</ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo>
> </ds:Signature>
> <saml2p:Status>
> <saml2p:StatusCode
> Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
> <saml2p:StatusCode
> Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
> </saml2p:StatusCode>
> <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
> </saml2p:Status>
> </saml2p:Response>
>
>
> The main error that I can see here is the following:
> <saml2p:Status>
> <saml2p:StatusCode
> Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
> <saml2p:StatusCode
> Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
> </saml2p:StatusCode>
> <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
> </saml2p:Status>
>
>
> Here is what my code looks for "Attribute-Filter.xml"
> 419
> 420 <afp:AttributeFilterPolicy id="docusign">
> 421 <afp:PolicyRequirementRule
> xsi:type="basic:AttributeRequesterString"
> value="https://account-d.docusign.com/organizations/37269197-2dd0-49da-8668-526cf
> e2e4c56/saml2" />
> 422
> 423 <afp:AttributeRule attributeID="NameID">
> 424 <afp:PermitValueRule xsi:type="basic:ANY" />
> 425 </afp:AttributeRule>
> 426 <afp:AttributeRule attributeID="mail">
> 427 <afp:PermitValueRule xsi:type="basic:ANY" />
> 428 </afp:AttributeRule>
> 429 <afp:AttributeRule attributeID="givenName">
> 430 <afp:PermitValueRule xsi:type="basic:ANY" />
> 431 </afp:AttributeRule>
> 432 <afp:AttributeRule attributeID="surname">
> 433 <afp:PermitValueRule xsi:type="basic:ANY" />
> 434 </afp:AttributeRule>
> 435 </afp:AttributeFilterPolicy>
> 436
>
>
>
> Code for "saml-nameid.xml"
>
> 57 <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
> 58
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> 59 p:attributeSourceIds="#{ {'NameID'} }">
> 60 <property name="activationCondition">
> 61 <bean parent="shibboleth.Conditions.RelyingPartyId"
> c:candidate="https://account-d.docusign.com/organizations/37269197-2dd0-49da-8668-526cf
> e2e4c56/saml2" />
> 62 </property>
> 63 </bean>
>
>
> Code for "metadata-provides.xml"
> 213 <MetadataProvider id="docusign"
> 214 xsi:type="FileBackedHTTPMetadataProvider"
> 215 xmlns="urn:mace:shibboleth:2.0:metadata"
> 216
> metadataURL="https://account-d.docusign.com/organizations/37269197-2dd0-49da-8668-526cfe2e4c56/saml2/metadata"
> 217
> backingFile="/opt/shibboleth-idp/metadata/docusign-metadata.xml" />
>
>
> Disabling Encryption for "relying-party.xml"
>
> Code for "relying-party.xml"
> 97 <bean parent="RelyingPartyByName"
> c:relyingPartyIds="https://account-d.docusign.com/organizations/37269197-2dd0-49da-8668-526cfe2e4c56/saml2">
> 98 <property name="profileConfigurations">
> 99 <list>
> 100 <bean parent="SAML2.SSO" p:encryptAssertions="false"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> />
> 101 </list>
> 102 </property>
> 103 </bean>
>
> Code for "saml-nameid.properties"
> 7 # Comment out to disable legacy NameID generation via Attribute Resolver
> 8 idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator
> 9 idp.nameid.saml1.legacyGenerator =
> shibboleth.LegacySAML1NameIdentifierGenerator
>
> I enabled these just in case, but it still didn't work.
>
>
>
>
>
>
>
>
>
> -----
> Thank you!
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/DocuSign-SSO-issues-on-Dev-environment-tp7629901.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
More information about the users
mailing list