Integration with a Simitive SP

[Todd, James]

Hi Chris, and anyone else who has dealt with Simitive:

Just a follow up to this, you say they wanted a subject nameid - am I correct in thinking they essentially wanted your staff Usernames or HR numbers transmitted as the SAML Subject? And with a format of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent? We're past our encryption problems but now we're at problems with matching up what we're transmitting with what they're expecting.

I was originally transmitting a computed persistentID under format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent as the SAML Subject, then sending the userID as another attribute, as I do for other SPs who need the Windows Username, but it turns out they're trying to match the SAML Subject I'm transmitting with the UID they've had synced separately from our staff database which of course doesn't match up. The only way I can probably release the UserID as the SAML subject is probably with a nameid format of urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified. However they sent me a copy of their attribute-map.xml which doesn't seem to have this nameid format present.

I've told them they should either get the Username out of the attribute statement rather than the subject statement like every other SP we deal with or add urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified to their attribute-map if they must have a username as the SAML Subject. I cannot send a username with a persistent name format, my IdP wouldn't allow it. Nor would I want to anyway, given the OASIS spec for SAML2.

I'm curious, though - as we're not the first Uni to deal with them: did anyone else "break" the SAML spec to work with them and send them a username as a persistentID, or did you force them to work under the SAML spec? It might be easier if I can get them to look at the config for another Uni they deal with and copy that, but only if nobody else bent their IdP out of shape to fit what they need...

Cheers
James

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Chris Reeves
Sent: 07 September 2016 15:59
To: Shib Users <users at shibboleth.net>
Subject: Re: Integration with a Simitive SP

On Wed 07 Sep 2016 at 15:00:05 +0100, Cantor, Scott wrote:
> On 9/7/16, 9:57 AM, Todd, James wrote:
> >
> > Thanks, Scott. I know I answered my own questions but when a vendor
> > who has dealt with integration with other Universities threw this at
> > me, then told me to read the Shibboleth documentation I really started to doubt myself or my own sanity. Sanity restored.
>
> Certainly makes you wonder what the other universities did.

Hi James,

Our integration with Simitive was quite painful (our instance was the most recent Simitive SP to be added to the UK Federation). They asked for our entityId and an attribute to release as a unique ID (they actually wanted a Subject NameID). We gave them that and pointed them at the UK Federation metadata for anything else they needed.

Once they had registered with the federation the configuration on our side was quite straightforward and didn't need much further modification (other than having to release an additional attribute that they don't actually use).
Things didn't go quite so smoothly on their side though, and in the end they had to call in consultants to get the SP working. :-S

Regards,
    Chris
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
This message and its attachment(s) are intended for the addressee(s) only and should not be read, copied, disclosed, forwarded or relied upon by any person other than the intended addressee(s) without the permission of the sender. If you are not the intended addressee you must not take any action based on this message and its attachment(s) nor must you copy or show them to anyone. Please respond to the sender and ensure that this message and its attachment(s) are deleted.

It is your responsibility to ensure that this message and its attachment(s) are scanned for viruses or other defects. Edinburgh Napier University does not accept liability for any loss or damage which may result from this message or its attachment(s), or for errors or omissions arising after it was sent. Email is not a secure medium. Emails entering Edinburgh Napier University's system are subject to routine monitoring and filtering by Edinburgh Napier University.

Edinburgh Napier University is a registered Scottish charity. Registration number SC018373