Anyone using Shibboleth with JAMF?

[Mark Cairney]

Hi,

Is there anyone, particularly in the UK Federation, using JAMF with
Shibboleth?

Their Web Single-sign on claims to work with Shibboleth:
<https://www.jamf.com/jamf-nation/articles/437/configuring-single-sign-on-with-shibboleth>

However it appears to insist on using the nameID and from what I can
tell, though I may be wrong, that the nameID contain the user token
(uid/ EPPN/ mail) being used to match within the application and that
the nameID is part of the subject not an attribute.

I've been wrestling with putting in hacks in our config to do this but
so far without success.

What I have just now for JAMF-specific config is:

relying-party.xml:

 <bean parent="RelyingPartyByName"
c:relyingPartyIds="https://uoe.jamfcloud.com/saml/metadata">
        <property name="profileConfigurations">
            <list>
              <!--  <bean parent="SAML2.SSO" p:encryptAssertions="never"
p:signAssertions="never" p:encryptNameIDs="never" p:signResponses="true"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
-->
              <bean parent="SAML2.SSO" p:encryptAssertions="never"
p:signAssertions="never" p:encryptNameIDs="never"
p:signResponses="never"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"/>
        <ref bean="SAML2.Logout" />
            </list>
        </property>
    </bean>

attribute-resolver.xml:

 <resolver:AttributeDefinition id="JAMF.uid" xsi:type="ad:Simple"
sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"

nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
nameQualifier="https://uoe.jamfcloud.com/saml/metadata"/>
 </resolver:AttributeDefinition>

    <!-- Add group memberships for JAMF -->
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="JAMFgroup"
sourceAttributeID="memberOf">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:memberOf" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="http://schemas.xmlsoap.org/claims/Group" friendlyName="JAMFgroup"
encodeType="false" />
    </resolver:AttributeDefinition>


and finally in my attribute-filter.xml:

  <afp:AttributeFilterPolicy id="JAMF">
    <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="https://uoe.jamfcloud.com/saml/metadata"/>
    <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
      <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
    <afp:AttributeRule attributeID="JAMF.uid">
      <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
    <afp:AttributeRule attributeID="uid">
      <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
   <afp:AttributeRule attributeID="mail">
      <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
   <afp:AttributeRule attributeID="eduPersonPrincipalName">
      <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
        <afp:AttributeRule attributeID="JAMFgroup">
      <afp:PermitValueRule xsi:type="basic:ANY"/>
    </afp:AttributeRule>
  </afp:AttributeFilterPolicy>


However I'm still not seeing the nameID appear looking at SAML tracer.
If I use the same format for the JAMF version of uid as
edupersontargetedid it does appear in the assertion but in the attribute
section rather than the subject.


-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170607/48aa8877/attachment.sig>