users Digest, Vol 72, Issue 104

Tue Jun 13 13:35:17 EDT 2017

Thanks PETER,

Will this work for 3.2.1?

===========================

Thank You;

Chris Cheltenham
Technology Services
The School District of Philadelphia

Work # 215-400-5025
Cell # 215-301-6571

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of
users-request at shibboleth.net
Sent: Tuesday, June 13, 2017 1:30 PM
To: users at shibboleth.net
Subject: users Digest, Vol 72, Issue 104

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than
"Re: Contents of users digest..."

Today's Topics:

   1. Re: release a non existent attribute as a specific value
      (Peter Schober)
   2. IDP 3.3 - MFA Conditional via IP Address (Krug, Jeff)
   3. Re: IDP 3.3 - MFA Conditional via IP Address (Cantor, Scott)
   4. staic connectors (Cheltenham, Chris)

----------------------------------------------------------------------

Message: 1
Date: Tue, 13 Jun 2017 18:26:58 +0200
From: Peter Schober <peter.schober at univie.ac.at>
To: users at shibboleth.net
Subject: Re: release a non existent attribute as a specific value
Message-ID: <20170613162658.GV20496 at aco.net>
Content-Type: text/plain; charset=utf-8

* Cheltenham, Chris <ccheltenham-ext at philasd.org> [2017-06-13 16:37]:
> The app is looking for 'accountID' attribute. [?] How do I create a 
> resolver attribute to push one specific value only?

E.g.:

    <AttributeDefinition id="someVendorCrap" xsi:type="Simple"
sourceAttributeID="someVendorAccountID">
        <Dependency ref="staticAttributes" />
        <AttributeEncoder xsi:type="SAML2String"
name="THE-DESIRED-FORMAL-ATTRIBUTE-NAME" friendlyName="WHATEVER"
encodeType="false" />
    </AttributeDefinition>

    <DataConnector id="staticAttributes" xsi:type="Static">
        <Attribute id="someVendorAccountID">
            <Value>WHATEVER-YOU-WANT</Value>
        </Attribute>
	<!-- possibly more static Attribute defintions -->
    </DataConnector>

Then release "someVendorCrap" in your attribute-filter.xml, only to that
SP.

-peter

------------------------------

Message: 2
Date: Tue, 13 Jun 2017 17:15:45 +0000
From: "Krug, Jeff" <Jeff.Krug at gtri.gatech.edu>
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: IDP 3.3 - MFA Conditional via IP Address
Message-ID: <f5b07d590dea45e1bfba5ff465019508 at gtri.gatech.edu>
Content-Type: text/plain; charset="iso-8859-1"

I thought I had seen an example of this on the wiki, but I can't seem to
find it anymore.

I am using IDP 3.3 to do MFA with a custom second factor I wrote, but I
want to also make the use of the 2nd factor optional depending on the IP
Address of the user (I have it conditional based on whether they have a
2nd factor configured or not; that was easy to do based on the attribute
lookup example).

Basically if they are on the local/physical network they don't need to use
their token.  Is there a good example of this somewhere?

Thanks,
Jeff

----------------
Jeffrey Krug (jeffrey.krug at gtri.gatech.edu)
Phone: 404-407-7903

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/11083492/attac
hment-0001.html>

------------------------------

Message: 3
Date: Tue, 13 Jun 2017 17:24:49 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3 - MFA Conditional via IP Address
Message-ID: <D2497D9C-1B65-46CA-87B3-769170BAB2E4 at osu.edu>
Content-Type: text/plain; charset="utf-8"

On 6/13/17, 1:15 PM, "users on behalf of Krug, Jeff"
<users-bounces at shibboleth.net on behalf of Jeff.Krug at gtri.gatech.edu>
wrote:

> I am using IDP 3.3 to do MFA with a custom second factor I wrote, but 
> I want to also make the use of the 2nd factor optional depending on 
> the IP Address of the user (I have it conditional based on whether they
have a 2nd factor configured or not; that was easy to do based on the
attribute lookup example).

Inject an instance of shibboleth.HttpServletRequest as a custom object
into your scripted function.

If you want something fancier, there's already an IPRangePredicate
implemented that you could instantiate and use to take most of the work
off you. It's used inside the access-control layer so there are examples
of the wiring there.

I'd caution that a lot of proxied/load-balanced deployments are probably
not providing the address safely (and you're trying to use it for a
security control, that's why I mention it).

-- Scott

------------------------------

Message: 4
Date: Tue, 13 Jun 2017 13:30:04 -0400 (EDT)
From: "Cheltenham, Chris" <ccheltenham-ext at philasd.org>
To: <users at shibboleth.net>
Subject: staic connectors
Message-ID: <00dd01d2e46a$b150e220$13f2a660$@philasd.org>
Content-Type: text/plain; charset="us-ascii"

Hello,

We are trying to release a dummy attribute that is the same value every
time.

It is not in LDAP and it is required by the stupid application. 

I will push the same value for everyone all the time.

I am using static connectors but I cannot see why this fails.

Does anyone see why in attribute-resolver.xml

Shib 3.2.1

<resolver:AttributeDefinition xsi:type="ad:Simple" id="iReadyaccountID"
sourceAttributeID="iReadyaccountID">

        <resolver:Dependency ref="staticAttributes" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="accountID" friendlyName="accountID" encodeType="false" />

</resolver:AttributeDefinition>

<resolver:DataConnector id="staticAttributes" xsi:type="dc:Static">

     <Attribute id="accountID">

        <Value>phila26432</Value>

     </Attribute>

</resolver:DataConnector>

The error I get is with the the data connector's attributeID.

[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; 

lineNumber: 190; columnNumber: 32; cvc-complex-type.2.4.a: Invalid content
was found starting with element 'Attribute'. 

One of '{"urn:mace:shibboleth:2.0:resolver":Dependency,
"urn:mace:shibboleth:2.0:resolver":FailoverDataConnector, 

"urn:mace:shibboleth:2.0:resolver:dc":Attribute}' is
expected.</u></p><p><b>description</b> <u>

The server encountered an internal error that prevented it from fulfilling
this request.

===========================

Thank You;

Chris Cheltenham
Technology Services
The School District of Philadelphia

Work # 215-400-5025
Cell # 215-301-6571 

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/0c814d33/attac
hment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 1089 bytes
Desc: not available
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/0c814d33/attac
hment.gif>

------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 72, Issue 104
**************************************