Federation with Concur?

[Doan, Tommy]

As the author of https://wiki.shibboleth.net/confluence/display/SHIB2/Concur+Solutions, I welcome any edits! I'm surprised the article's been there as long as it has with no contributions/corrections - I wrote it up when all of this was still quite new to me. I still have not yet made any changes to our attribute definition even after our v3 upgrade since I wanted to minimize changes, and it appears to behave. At some point I suppose I'll need to update the NameID format and update the article - or maybe someone more experienced will do it for me... wink. 

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of David Gersic
Sent: Tuesday, November 3, 2015 10:53 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Federation with Concur?

Thanks Scott.

________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Tuesday, November 03, 2015 10:27 AM
To: Shib Users
Subject: Re: Federation with Concur?

On 11/3/15, 11:09 AM, "users on behalf of David Gersic" <users-bounces at shibboleth.net on behalf of dgersic at niu.edu> wrote:



>In the metadata configuration, he has the entityID as  entityID="https://www.concursolutions.com" where I think it should be  entityID="https://www.concursolutions.com/"  The trailing slash is important. Maybe this changed between when he wrote it and now, but the XML I got from Concur has the trailing slash in it.

Mine does not.

>where it looks like Scoped:
>
>    <resolver:AttributeDefinition xsi:type="ad:Scoped" xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="ConcurNameID" scope="yourdomain.edu" sourceAttributeID="uid">
>        <resolver:Dependency ref="myLDAP" />
>            <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
>                xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" />
>    </resolver:AttributeDefinition>
>
> would be simpler, at least to me.

This isn't a scoped attribute, it's a custom attribute that's going to end up in a NameID and happens to have a domain in it. Scoped should never be used with formally unscoped data, it can completely alter the data serialization performed.

>Is there any effective difference here, assuming that domain.edu is the same for both definitions?

Very much so.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net