Configuring Concur for Shibboleth 3

[Cantor, Scott]

On 4/19/17, 2:46 PM, "users on behalf of Daniel Conner" <users-bounces at shibboleth.net on behalf of dconner5 at avc.edu> wrote:

> I included my applicable configuration with you all below including: attribute-resolver.xml, relying-party.xml, metadata-
> providers.xml, saml-nameid.xml, and saml-nameid.properties. Any help would be greatly appreciated.

What SAML requirement are you trying to meet that isn't being met? You can't debug "error" from an app. Somebody on that end has to tell you what the error is.

> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"

You don't need to use that format. I do not (we have Concur), therefore you don't. So don't.

> <bean parent="RelyingPartyByName" c:relyingPartyIds="https://implementation.concursolutions.com">

If that's the entityID, then why does your filter policy use something else for the Requester rule?

> <bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptionOptional="true" p:signAssertions="true" />

Why are you setting both encryptAssertions and encryptionOptional? If you want encryption off for one SP, use encryptAssertions=false. If you want to use the optional encryption setting, don't do this, just set the property globally as documented.

> SAML-NAMEID.XML

You don't use this *and* use the attribute resolver to generate NameIDs, and you seem to be using the resolver to do it.

-- Scott