Question about G Suite authentication via Shibboleth.

[Domingues, Michael D]

Google doesn't actually care what you call the NameID format, they just care that the value contained in the NameID is correct. Here's the approach you'll want to take. Note that this process assume you've checked the "use domain specific issuer" box in the Google Admin Panel to get an SP entityID that is custom to your tenant.


1. Wire up an appropriate well-named custom NameID format in saml-nameid.xml. See the Shibboleth documentation on how to do this here [1]
2. Create metadata for your GSuite tenant. Specify your NameID format explicitly in it with a <NameIDFormat></NameIDFormat> child element under <SPSSODescriptor> like so:


<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="google.com/a/your.tenant.domain">
  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <NameIDFormat>your-well-named-format-here</NameIDFormat>
    <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                Location="https://www.google.com/a/your.tenant.domain/acs" />
    <AttributeConsumingService index="1">
      <ServiceName xml:lang="en">Your GSuite Tenant Name for UI Display</ServiceName>
    </AttributeConsumingService>
  </SPSSODescriptor>
</EntityDescriptor>

3. Edit attribute-filter.xml to ensure that you are releasing the source attribute for this NameID format to your GSuite tenant's entityID
4. Add a relying-party.xml entry for your GSuite tenant. Since you'll have specified the NameID format in the metadata you generate, the "nameIDFormatPrecedence" line isn't strictly necessary, but I included it for consistency with our approach with other SPs:

<!-- Google Apps does not support encrypted assertions, and strictly expects there to not be an
   attribute statment included in the assertion. It also requires a custom NameID format that matches
   the synchronized username. -->
<bean parent="RelyingPartyByName" c:relyingPartyIds="google.com/a/your.tenant.domain">
<property name="profileConfigurations">
  <list>
    <bean parent="SAML2.SSO"
        p:encryptAssertions="false"
        p:includeAttributeStatement="false"
        p:nameIDFormatPrecedence="your-name-id-format-here" />
  </list>
</property>
</bean>

For what it's worth, the NameID value doesn't have to be email address, it just has to match the username you have synchronized to GSuite. We're sending our HawkID (local name for NetID) as the NameID.

If you haven't found this page already, Google's (thoroughly underspecified) documentation on getting this set up can be found here [2]

Best,
Michael Domingues
Directory and Authentication Services, AIS, ITS
University of Iowa

[1] https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration
[2] https://support.google.com/a/answer/60224?hl=en&ref_topic=6348126

<https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration>


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Ernie Kinsey <Ernie.Kinsey at cpcc.edu>
Sent: Thursday, August 17, 2017 6:59:38 AM
To: users at shibboleth.net
Subject: Question about G Suite authentication via Shibboleth.

I'm having problems getting G Suite to work properly with Shibboleth.  What seems to be happening is that the "nameid-format" of the "NameID" attribute is beind delivered as "transient", as in:

<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp-test.cpcc.edu/idp/shibboleth" SPNameQualifier="google.com">AAdzZWNyZXQx95Th/b1Mlxm2jEP4c7FNo19z0EBTZWm38vkumXm1Mlrtj4UqsdHMotpDVLbwU/yf2qg+Bz1BNT0Z2x87/+eg2uf8DA76XTEZkr7GfBcrqEGa</saml2:NameID>

Based on the Google documentation, it's supposed to be "email" (for SAML 1.1) or "emailAddress" (for SAML 2.0).

I've mucked around in the assorted configuration files in the /conf folder, but I can't seem to force this attribute to be anything other than "transient".  To compound the problem, since the attribute IS "transient", the value I can see in the SAML message is "obscured" and I have no idea what value is actually being sent to G Suite - and the G Suite logging is inadequate to see what it thinks it's getting.

Any help would be appreciated.  For what it’s worth, I’ve done some due diligence by looking through the other items posted here that seem relevant to this problem, but am still stumped.

Thanks,
Ernest K. Kinsey, Jr.
Information Technology and Research Services
Central Piedmont Community College
Charlotte, NC 28255



________________________________

This e-mail, including any attachments, is intended only for the addressee's use and may contain confidential and proprietary information. If you are not the intended recipient, you are hereby notified that any retention, dissemination, reproduction, or use of the information contained in this e-mail is strictly prohibited. If you have received this e-mail by error, please delete it and immediately notify the sender. Thank you for your cooperation.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170817/168e9424/attachment-0001.html>