users Digest, Vol 72, Issue 105
Cheltenham, Chris
ccheltenham-ext at philasd.org
Wed Jun 14 08:21:19 EDT 2017
Thanks Peter, I appreciate it.
===========================
Thank You;
Chris Cheltenham
Technology Services
The School District of Philadelphia
Work # 215-400-5025
Cell # 215-301-6571
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of
users-request at shibboleth.net
Sent: Tuesday, June 13, 2017 2:46 PM
To: users at shibboleth.net
Subject: users Digest, Vol 72, Issue 105
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific than
"Re: Contents of users digest..."
Today's Topics:
1. RE: users Digest, Vol 72, Issue 104 (Cheltenham, Chris)
2. Re: staic connectors (Andrew Morgan)
3. Re: IDP 3.3 - MFA Conditional via IP Address (Krug, Jeff)
4. Re: IdP 3.3.1 - mac check in GCM failed (George Stoynev)
----------------------------------------------------------------------
Message: 1
Date: Tue, 13 Jun 2017 13:35:17 -0400 (EDT)
From: "Cheltenham, Chris" <ccheltenham-ext at philasd.org>
To: <users at shibboleth.net>
Subject: RE: users Digest, Vol 72, Issue 104
Message-ID: <00ee01d2e46b$6c00efc0$4402cf40$@philasd.org>
Content-Type: text/plain; charset="us-ascii"
Thanks PETER,
Will this work for 3.2.1?
===========================
Thank You;
Chris Cheltenham
Technology Services
The School District of Philadelphia
Work # 215-400-5025
Cell # 215-301-6571
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of
users-request at shibboleth.net
Sent: Tuesday, June 13, 2017 1:30 PM
To: users at shibboleth.net
Subject: users Digest, Vol 72, Issue 104
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific than
"Re: Contents of users digest..."
Today's Topics:
1. Re: release a non existent attribute as a specific value
(Peter Schober)
2. IDP 3.3 - MFA Conditional via IP Address (Krug, Jeff)
3. Re: IDP 3.3 - MFA Conditional via IP Address (Cantor, Scott)
4. staic connectors (Cheltenham, Chris)
----------------------------------------------------------------------
Message: 1
Date: Tue, 13 Jun 2017 18:26:58 +0200
From: Peter Schober <peter.schober at univie.ac.at>
To: users at shibboleth.net
Subject: Re: release a non existent attribute as a specific value
Message-ID: <20170613162658.GV20496 at aco.net>
Content-Type: text/plain; charset=utf-8
* Cheltenham, Chris <ccheltenham-ext at philasd.org> [2017-06-13 16:37]:
> The app is looking for 'accountID' attribute. [?] How do I create a
> resolver attribute to push one specific value only?
E.g.:
<AttributeDefinition id="someVendorCrap" xsi:type="Simple"
sourceAttributeID="someVendorAccountID">
<Dependency ref="staticAttributes" />
<AttributeEncoder xsi:type="SAML2String"
name="THE-DESIRED-FORMAL-ATTRIBUTE-NAME" friendlyName="WHATEVER"
encodeType="false" />
</AttributeDefinition>
<DataConnector id="staticAttributes" xsi:type="Static">
<Attribute id="someVendorAccountID">
<Value>WHATEVER-YOU-WANT</Value>
</Attribute>
<!-- possibly more static Attribute defintions -->
</DataConnector>
Then release "someVendorCrap" in your attribute-filter.xml, only to that
SP.
-peter
------------------------------
Message: 2
Date: Tue, 13 Jun 2017 17:15:45 +0000
From: "Krug, Jeff" <Jeff.Krug at gtri.gatech.edu>
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: IDP 3.3 - MFA Conditional via IP Address
Message-ID: <f5b07d590dea45e1bfba5ff465019508 at gtri.gatech.edu>
Content-Type: text/plain; charset="iso-8859-1"
I thought I had seen an example of this on the wiki, but I can't seem to
find it anymore.
I am using IDP 3.3 to do MFA with a custom second factor I wrote, but I
want to also make the use of the 2nd factor optional depending on the IP
Address of the user (I have it conditional based on whether they have a
2nd factor configured or not; that was easy to do based on the attribute
lookup example).
Basically if they are on the local/physical network they don't need to use
their token. Is there a good example of this somewhere?
Thanks,
Jeff
----------------
Jeffrey Krug (jeffrey.krug at gtri.gatech.edu)
Phone: 404-407-7903
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/11083492/attac
hment-0001.html>
------------------------------
Message: 3
Date: Tue, 13 Jun 2017 17:24:49 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3 - MFA Conditional via IP Address
Message-ID: <D2497D9C-1B65-46CA-87B3-769170BAB2E4 at osu.edu>
Content-Type: text/plain; charset="utf-8"
On 6/13/17, 1:15 PM, "users on behalf of Krug, Jeff"
<users-bounces at shibboleth.net on behalf of Jeff.Krug at gtri.gatech.edu>
wrote:
> I am using IDP 3.3 to do MFA with a custom second factor I wrote, but
> I want to also make the use of the 2nd factor optional depending on
> the IP Address of the user (I have it conditional based on whether
> they
have a 2nd factor configured or not; that was easy to do based on the
attribute lookup example).
Inject an instance of shibboleth.HttpServletRequest as a custom object
into your scripted function.
If you want something fancier, there's already an IPRangePredicate
implemented that you could instantiate and use to take most of the work
off you. It's used inside the access-control layer so there are examples
of the wiring there.
I'd caution that a lot of proxied/load-balanced deployments are probably
not providing the address safely (and you're trying to use it for a
security control, that's why I mention it).
-- Scott
------------------------------
Message: 4
Date: Tue, 13 Jun 2017 13:30:04 -0400 (EDT)
From: "Cheltenham, Chris" <ccheltenham-ext at philasd.org>
To: <users at shibboleth.net>
Subject: staic connectors
Message-ID: <00dd01d2e46a$b150e220$13f2a660$@philasd.org>
Content-Type: text/plain; charset="us-ascii"
Hello,
We are trying to release a dummy attribute that is the same value every
time.
It is not in LDAP and it is required by the stupid application.
I will push the same value for everyone all the time.
I am using static connectors but I cannot see why this fails.
Does anyone see why in attribute-resolver.xml
Shib 3.2.1
<resolver:AttributeDefinition xsi:type="ad:Simple" id="iReadyaccountID"
sourceAttributeID="iReadyaccountID">
<resolver:Dependency ref="staticAttributes" />
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="accountID" friendlyName="accountID" encodeType="false" />
</resolver:AttributeDefinition>
<resolver:DataConnector id="staticAttributes" xsi:type="dc:Static">
<Attribute id="accountID">
<Value>phila26432</Value>
</Attribute>
</resolver:DataConnector>
The error I get is with the the data connector's attributeID.
[/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
exception is org.xml.sax.SAXParseException;
lineNumber: 190; columnNumber: 32; cvc-complex-type.2.4.a: Invalid content
was found starting with element 'Attribute'.
One of '{"urn:mace:shibboleth:2.0:resolver":Dependency,
"urn:mace:shibboleth:2.0:resolver":FailoverDataConnector,
"urn:mace:shibboleth:2.0:resolver:dc":Attribute}' is
expected.</u></p><p><b>description</b> <u>
The server encountered an internal error that prevented it from fulfilling
this request.
===========================
Thank You;
Chris Cheltenham
Technology Services
The School District of Philadelphia
Work # 215-400-5025
Cell # 215-301-6571
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/0c814d33/attac
hment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 1089 bytes
Desc: not available
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/0c814d33/attac
hment.gif>
------------------------------
Subject: Digest Footer
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
------------------------------
End of users Digest, Vol 72, Issue 104
**************************************
------------------------------
Message: 2
Date: Tue, 13 Jun 2017 10:46:28 -0700 (PDT)
From: Andrew Morgan <morgan at orst.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: staic connectors
Message-ID:
<alpine.DEB.2.11.1706131045290.27533 at shell.onid.oregonstate.edu>
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
You probably need to prefix it with "dc:" to get the right XML namespace,
like this:
<resolver:DataConnector id="staticAttributes" xsi:type="dc:Static">
<dc:Attribute id="accountID">
<Value>phila26432</Value>
</dc:Attribute>
</resolver:DataConnector>
Andy
On Tue, 13 Jun 2017, Cheltenham, Chris wrote:
>
>
> Hello,
>
>
>
> We are trying to release a dummy attribute that is the same value
> every time.
>
> It is not in LDAP and it is required by the stupid application.
>
> I will push the same value for everyone all the time.
>
>
>
> I am using static connectors but I cannot see why this fails.
>
> Does anyone see why in attribute-resolver.xml
>
>
>
>
>
> Shib 3.2.1
>
>
>
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="iReadyaccountID"
> sourceAttributeID="iReadyaccountID">
>
> <resolver:Dependency ref="staticAttributes" />
>
> <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="accountID" friendlyName="accountID" encodeType="false" />
>
> </resolver:AttributeDefinition>
>
>
>
>
>
> <resolver:DataConnector id="staticAttributes" xsi:type="dc:Static">
>
> <Attribute id="accountID">
>
> <Value>phila26432</Value>
>
> </Attribute>
>
> </resolver:DataConnector>
>
>
>
> The error I get is with the the data connector's attributeID.
>
>
>
> [/opt/shibboleth-idp/conf/attribute-resolver.xml] is invalid; nested
> exception is org.xml.sax.SAXParseException;
>
> lineNumber: 190; columnNumber: 32; cvc-complex-type.2.4.a: Invalid
> content was found starting with element 'Attribute'.
>
> One of '{"urn:mace:shibboleth:2.0:resolver":Dependency,
> "urn:mace:shibboleth:2.0:resolver":FailoverDataConnector,
>
> "urn:mace:shibboleth:2.0:resolver:dc":Attribute}' is
> expected.</u></p><p><b>description</b> <u>
>
> The server encountered an internal error that prevented it from
> fulfilling this request.
>
>
>
> ===========================
>
> Thank You;
>
> Chris Cheltenham
> Technology Services
> The School District of Philadelphia
>
> Work # 215-400-5025
> Cell # 215-301-6571
>
>
------------------------------
Message: 3
Date: Tue, 13 Jun 2017 18:35:44 +0000
From: "Krug, Jeff" <Jeff.Krug at gtri.gatech.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3 - MFA Conditional via IP Address
Message-ID: <d8960906e20043ec8d6a17034c097906 at gtri.gatech.edu>
Content-Type: text/plain; charset="us-ascii"
Thanks. And yes, I will have to do quite a bit of proxy testing and
validation before I can consider this adequately secure to justify the
convenience, and even so I recognize it's a bit less secure.
-- Jeff
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott
<cantor.2 at osu.edu>
Sent: Tuesday, June 13, 2017 1:24:49 PM
To: Shib Users
Subject: Re: IDP 3.3 - MFA Conditional via IP Address
On 6/13/17, 1:15 PM, "users on behalf of Krug, Jeff"
<users-bounces at shibboleth.net on behalf of Jeff.Krug at gtri.gatech.edu>
wrote:
> I am using IDP 3.3 to do MFA with a custom second factor I wrote, but
> I want to also make the use of the 2nd factor optional depending on
> the IP Address of the user (I have it conditional based on whether they
have a 2nd factor configured or not; that was easy to do based on the
attribute lookup example).
Inject an instance of shibboleth.HttpServletRequest as a custom object
into your scripted function.
If you want something fancier, there's already an IPRangePredicate
implemented that you could instantiate and use to take most of the work
off you. It's used inside the access-control layer so there are examples
of the wiring there.
I'd caution that a lot of proxied/load-balanced deployments are probably
not providing the address safely (and you're trying to use it for a
security control, that's why I mention it).
-- Scott
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/d65e5fce/attac
hment-0001.html>
------------------------------
Message: 4
Date: Tue, 13 Jun 2017 14:46:20 -0400
From: George Stoynev <george.stoynev at mcgill.ca>
To: users at shibboleth.net
Subject: Re: IdP 3.3.1 - mac check in GCM failed
Message-ID: <197e5905-e0d5-dd6a-8acc-5f683fb7e229 at mcgill.ca>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Thank you Scott!
Please let me know if I should submit any report or if there is another
way to help with this.
All the best,
George
On 2017-06-13 12:00 PM, users-request at shibboleth.net wrote:
Message: 3
Date: Tue, 13 Jun 2017 15:19:05 +0000
From: "Cantor, Scott"<cantor.2 at osu.edu>
To: Shib Users<users at shibboleth.net>
Subject: Re: IdP 3.3.1 - mac check in GCM failed
Message-ID:<49C9360C-FDF6-41C1-9F63-269B321BA79B at osu.edu>
Content-Type: text/plain; charset="utf-8"
On 6/13/17, 10:58 AM, "users on behalf of George
Stoynev"<users-bounces at shibboleth.net on behalf of
george.stoynev at mcgill.ca> wrote:
> Comparing the logs from version 3.2.1 (since this is the common
> version on all 4 servers) - the error messages are present in RHEL7,
> Java 8 servers but not in the RHEL6, Java 7 ones.
Well, I would never mix versions for any length of time, but the algorithm
here isn't actually JDK code, it's Bouncy Castle. GCM wasn't in Java 7, so
that among other reasons is why I used the BC APIs directly.
Unfortunately for your theory, I use CentOS 7 and Oracle Java 8 myself, no
error of this sort. But that certainly points to a problem on those
servers.
> Any clue of what else to look at?
None.
Maybe there's a conflicting Bouncy Castle jar somewhere getting pulled in
by some extension?
Really no idea. Nobody has reported anything like it and I've been using
that code since I went live, have had no problems with it.
-- Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://shibboleth.net/pipermail/users/attachments/20170613/d8a160b0/attac
hment.html>
------------------------------
Subject: Digest Footer
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
------------------------------
End of users Digest, Vol 72, Issue 105
**************************************
More information about the users
mailing list