SSO with multiple Google domains

[Knape, Dean M.]

Andy,

I'm talking about a single instance with multiple domains registered.  In
your case, email to either of the defined addresses delivers to a single
mailbox.  This is effectively what we have now, which is turning into some
very difficult to resolve use cases.

dean

On Thu, Nov 2, 2017 at 11:47 AM, Andrew Morgan <morgan at orst.edu> wrote:

> On Thu, 2 Nov 2017, Knape, Dean M. wrote:
>
> Hello,
>>
>> We're a G Suite for Education customer and are exploring supporting a
>> setup
>> consisting of a primary domain and multiple secondary domains, where a
>> user
>> may exist in one or more of the domains simultaneously and the user's
>> username would be common across domains.
>>
>> Unfortunately, Google is not able to issue domain specific authentication
>> requests for this type setup.  The ACS URL and Issuer are based on the
>> primary domain in all cases.
>>
>> Google is suggesting using the relay state of the authentication request
>> to
>> derive domain information which can then be used to build the appropriate
>> email address for the SAML response.  Is this something that can be done
>> in
>> the IdP?
>>
>> Are there other options/recommendations?
>>
>> dean
>>
>
> Dean,
>
> Do you have multiple instances of G Suite or one instance with multiple
> domains registered?
>
> We have both, actually, because we have a test instance of G Suite and a
> production instance of G Suite.  In both of those instances, our users have
> multiple domains on their accounts, all with the same username (left-hand
> of at-sign).
>
> When we auth for the production instance, we always assert the primary
> domain back to Google.  Let me give you a concrete example...
>
> My Google account:
>
>   User: morgan at oregonstate.edu
>   Aliases: morgan at onid.oregonstate.edu
>
> I can type either of these usernames into Google's login form and they
> will redirect me to our IDP.  In the SAML assertion back to Google, we
> assert the NameID with a value of "morgan at oregonstate.edu".
>
> Internally, we implemented this by creating a new attribute in LDAP named
> "googlePrincipalName".  We store the user's Google username in that
> attribute, and Shibboleth resolves it to generate the NameID value. Perhaps
> you can use this method to store the correct mapping to Google username for
> each user.
>
> Thanks,
>         Andy
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 

Dean Knape
University Information Systems
NJ Institute of Technology
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171102/6811f031/attachment.html>