Tableau SAML auth

[Julian Williams]

On 01/09/16 22:57, Paul B. Henson wrote:
>> From: Cantor, Scott Sent: Wednesday, August 31, 2016 4:24 PM
>> 
>> Ok, that's pretty bad. Obviously you're not giving them your
>> private key and it's certainly none of their business if it's
>> passworded or not.
> 
> Oh, that's for setting up the tableau SP side, not the idp side; it's
> not a "cloud" application, it's a local application, so you need to
> configure both the idp and SP sides of it.
> 
>> Logout endpoints aren't indexed. I'm sure their logout
>> implementation works great too.
> 
> I'm not sure, we don't currently have SingleLogout enabled. We did
> get it working, the only other snag was that initially we configured
> the SP side to look for the friendly name of the attribute "uid" and
> we needed to configure it to look for the urn-based name
> "urn:oid:0.9.2342.19200300.100.1.1" instead.

Late to the party but we are also using Tableau (v9.1.9 I believe) with
Shibboleth (but not in production yet).

It looks like the metadata we are using has been edited so no
SingleLogoutService binding is present. We don't provide a SLO service
here yet anyway.

We *are* using encrypted assertions with it, as you've also discovered
is possible.

Our main problem with it has been that it wasn't flexible in handling
the scoped ePPN that we would normally provide as an ID. It couldn't
de-scope it and this prevented matching up with existing user accounts
in the AD domain that it is deployed in (and happens to be a different
domain that doesn't match the scope). So we ended up having to provide
an unscoped uid to it (as you are doing) which is the first case of us
having to do that.

Cheers,

Julian

-- 
Julian Williams (Systems Developer, Identity and Access Management)
Systems Development and Support, IT Services, University of Oxford