users Digest, Vol 72, Issue 96

Tue Jun 13 08:15:39 EDT 2017

Thanks Scott,

So you are saying the SP's encryption key does not match the metadata?

===========================

Thank You;

Chris Cheltenham
Technology Services
The School District of Philadelphia

Work # 215-400-5025
Cell # 215-301-6571
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of
users-request at shibboleth.net
Sent: Tuesday, June 13, 2017 8:07 AM
To: users at shibboleth.net
Subject: users Digest, Vol 72, Issue 96

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than
"Re: Contents of users digest..."

Today's Topics:

   1. Re: Need help in shibboleth configuration (Cantor, Scott)
   2. RE: CAS attribute naming (Rod Widdowson)
   3. ContextCheckInterceptConfiguration - IDP Authorization
      (Vipin Jain)
   4. certificate error in metadata (Cheltenham, Chris)

----------------------------------------------------------------------

Message: 1
Date: Tue, 13 Jun 2017 03:10:54 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: Need help in shibboleth configuration
Message-ID: <CED43109-9493-4413-AC38-2FA11DD9CDF4 at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 6/12/17, 10:16 PM, "users on behalf of bhupendra.a.singh at accenture.com"
<users-bounces at shibboleth.net on behalf of
bhupendra.a.singh at accenture.com> wrote:

> I am facing below error while setting up the SSL certificate for 
> shibboleth integration with ADFS. Please provide help to fix the issue.

No, this is not the SSL certificate. This is the SAML encryption key used
by the SP, it has nothing to do with SSL.

You have a permission error, which you created yourself by changing the
location of the key. The keypair should be in /etc/shibboleth, and should
be owned by shibd. It should not be an SSL certificate, it should be
self-signed, and should not be the same key used by the web server.

All of that is done for you at installation.

-- Scott

------------------------------

Message: 2
Date: Tue, 13 Jun 2017 09:36:05 +0100
From: "Rod Widdowson" <rdw at steadingsoftware.com>
To: "'Shib Users'" <users at shibboleth.net>
Subject: RE: CAS attribute naming
Message-ID: <009d01d2e420$1954cd00$4bfe6700$@steadingsoftware.com>
Content-Type: text/plain;	charset="Windows-1252"

> we need to come up with a separate and easier-to-configure strategy for
that. 

This ties in with the whole "want to source 'attributes on the wire
directly' from DataConnectors" issue.

Every time I go there I come up dry of ideas on how to do this.  Options
include (and they are not mutually exclusive)

- Entirely exbedding encoding from the attribute definition (and thus
collapsing the somewhat weird distinction between "attributes from a
dataconnector" and "attributes from a definition" - although that then
gets into some very subtle dependency issues.

- Having some sort of "per protocol (or profile?)" encoder with some
automagical mechanism to generate the name.  You could consider CAS to be
a degenerate case of that.  I falter at the "automagic" bit though.
Velocity? 

There are a lot of deployers out there.  How would you want to see this
addressed?

/Rod

------------------------------

Message: 3
Date: Tue, 13 Jun 2017 16:39:11 +0530
From: Vipin Jain <vjain at simeiosolutions.com>
To: Shib Users <users at shibboleth.net>
Subject: ContextCheckInterceptConfiguration - IDP Authorization
Message-ID:

<CAPWcJtcEd52Bvoy2CY=AJCPgczXHxiAqGPzu=t1bybFeNJ0Aog at mail.gmail.com>
Content-Type: text/plain; charset="utf-8"

Hello Team,

We are looking for an option where we can do authorization at IDP level
and seeing if we can use below concept, Does anybody have an example or
even done it?

https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckIntercept
Configuration

Thanks
Vipin Jain?

--
The information in this message may contain confidential information and
may be legally privileged. It is intended solely for the individual(s)
named. Access to this email by anyone else is unauthorized. Please notify
the sender immediately if you have received this email by mistake and
delete this email from your system. If you are not the intended recipient,
any disclosure, copying, distribution or any action taken or omitted to be
taken in reliance on it, is prohibited and may be unlawful. Email
transmission cannot be guaranteed to be secure or error-free, as
information could be intercepted, corrupted, lost, destroyed, arrive late
or incomplete, or contain viruses. When addressed to our clients any
decisions or recommendations contained in this email are subject to the
terms and conditions expressed our contract and related statement of work
letter(s)
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/c22b8512/attac
hment-0001.html>

------------------------------

Message: 4
Date: Tue, 13 Jun 2017 08:06:48 -0400 (EDT)
From: "Cheltenham, Chris" <ccheltenham-ext at philasd.org>
To: <users at shibboleth.net>
Cc: "'Sanchez, Sal'" <sal.sanchez at mheducation.com>, "'Disantis,
	Monika'" <mdisantis at philasd.org>, "'Newman, Yehuda'"
	<yehuda.newman at mheducation.com>
Subject: certificate error in metadata
Message-ID: <001901d2e43d$88f37400$9ada5c00$@philasd.org>
Content-Type: text/plain; charset="us-ascii"

Hello Everyone,

We are consistently getting this error in Shib 3.2.1 when launching as SP
initiated.

2017-06-13 07:59:12,983 - ERROR
[org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:300] -
Credential failed name check:
[subjectName='CN=aairs.tegrity.com,O=Mcgraw-Hill
Education,ST=Some-State,C=US']

Any help with what Shib is complaining about?

===========================

Thank You;

Chris Cheltenham
Technology Services
The School District of Philadelphia

Work # 215-400-5025
Cell # 215-301-6571 

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/b861b768/attac
hment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 1089 bytes
Desc: not available
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/b861b768/attac
hment.gif>

------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 72, Issue 96
*************************************