Banner 9 SAML

[Jeffrey Crawford]

I also did just notice that we had to downgrade the signature signing
algorithm to sha-1 and the assertion is unencrypted. Also for some reason
if the nameid isn't email, it doesn't like that either. Although it was
never clear as to what it actually did with the nameid. Once we got through
that it seemed to plug in rather easily, I can as the tech on the banner
side what settings we set there if there is interest.

Jeffrey E. Crawford
Enterprise Service Team <jeffreyc at ucsc.edu>
    ^         ^
   / \  ^    / \    ^
  /   \/ \  /   \  / \
 /        \/     \/   \
/                      \

You have been assigned this mountain to prove to others that it *can* be
moved.

On Thu, Nov 2, 2017 at 3:34 PM, Tom O'Neill <oneill at sigcorp.com> wrote:

> Yes, the UDC_IDENTIFIER attribute is required but isn't the tricky part of
> the configuration.
>
> I've had issues with the SAML 2.0 configuration for the Banner 9
> components.
> The last time I worked on a full SAML 2.0 stack we had SSO Manager,
> Application Navigator and a SSB module working but Admin Pages was trouble.
> I'd imagine it can be done - we were working with Ellucian Ethos Identity
> at the time, which isn't my preferred IdP but it didn't seem to be a mature
> integration yet.
>
> Thanks,
>
>     Tom O'Neill
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Jorj Bauer
> Sent: Thursday, November 02, 2017 3:32 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: Banner 9 SAML
>
> We had a small host of tiny details that had to be divined. The UDCID is
> critical and reasonably obvious.
>
> I think our initial CAS setup was about 3 weeks of various staff from IAM
> or the ERP team. Our SAML attempts are probably the same order of magnitude.
>
> Sent from my iPhone
>
> On Nov 2, 2017, at 14:53, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> >>> We did get it to work but it's very custom, we had to create the
> following
> >> resolver which is released only to Banner:
> >
> > If all it takes is a custom attribute then people need to recalibrate
> what they think "doesn't work easily" means. You're not going to get much
> better from a whole lot of vendors.
> >
> > -- Scott
> >
> > --
> > For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171103/d41fdb8e/attachment.html>