Configuring Concur for Shibboleth 3

[Daniel Conner]

We are working on configuring SSO for Concur. We are using. We followed the
instructions, but am not sure why the SSO is failing. The url we are using
is
https://our-idp-host.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://implementation.concursolutions.com.
The url brings up our login page. The login portion against our ldap is
working in that if I enter a bogus username and password, I am prompted to
enter a correct password. When I use valid credentials, I am forwarded to:
https://implementation.concursolutions.com/?result=InvalidXML



I included my applicable configuration with you all below including:
attribute-resolver.xml, relying-party.xml, metadata-providers.xml,
saml-nameid.xml, and saml-nameid.properties. Any help would be greatly
appreciated.



ATTRIBUTE-RESOLVER.XML



    <resolver:AttributeDefinition xsi:type="ad:Simple" id="ConcurID"
sourceAttributeID="mail">

        <resolver:Dependency ref="myLDAP" />

        <resolver:AttributeEncoder

             xsi:type="enc:SAML2StringNameID"


nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"

        />

    </resolver:AttributeDefinition>



ATTRIBUTE-FILTER.XML

          <AttributeFilterPolicy id="releaseToConcur">

             <PolicyRequirementRule xsi:type="Requester" value="https//
implementation.concursolutions.com/SAMLRedirector/ClientSAMLLogin.aspx" />

             <AttributeRule attributeID="ConcurID">

                   <PermitValueRule xsi:type="ANY" />

             </AttributeRule>

          </AttributeFilterPolicy>



RELYING-PARTY.XML



        <bean parent="RelyingPartyByName" c:relyingPartyIds="
https://implementation.concursolutions.com">

            <property name="profileConfigurations">

                <list>

                    <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:encryptionOptional="true" p:signAssertions="true" />

                </list>

            </property>

        </bean>



METADATA-PROVIDERS.XML



  <MetadataProvider id="ConcurAVC" xsi:type="FilesystemMetadataProvider"

        metadataFile="%{idp.home}/metadata/concur-test-metadata.xml">

  </MetadataProvider>





SAML-NAMEID.XML

    <!-- SAML 2 NameID Generation -->

    <util:list id="shibboleth.SAML2NameIDGenerators">



        <ref bean="shibboleth.SAML2TransientGenerator" />



        <!-- Uncommenting this bean requires configuration in
saml-nameid.properties. -->



<!--        <ref bean="shibboleth.SAML2PersistentGenerator" />-->







        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

           <!--
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"-->

           p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"

            p:attributeSourceIds="#{ {'mail'} }" />





    </util:list>





SAML-NAMEID.PROPERTIES

# Comment out to disable legacy NameID generation via Attribute Resolver

idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator

#idp.nameid.saml1.legacyGenerator =
shibboleth.LegacySAML1NameIdentifierGenerator
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170419/0cad2148/attachment-0001.html>