Login Authentication page for shibboleth IDP

[Santu Ghosh]

Thanks Alan, David, Scott and Tom

Most probably I found the problem (but not sure). My IDP is not signed but
my SP is signed *(AuthnRequestsSigned="true" )*. As a result my idp was
unable to process my SP.
With unsigned metadata of my SP, I can successfully start unsolicited SSO.

Can you please clear my bellow doubt ?

1) If SP metadata is signed and IDP metadata is not signed, then
unsolicited SSO will not work.
2) If SP metadata is signed and IDP metadata is not signed, then SP
initiated SSO will work.
3)If SP metadata is signed and IDP metadata is also signed, then
unsolicited SSO will work.

Please clear points.



Another question is, after successful login (unsolicited SSO) I got only
uid as my return attribute list.

here is my configuration :

1) ldap.properties

    #idp.attribute.resolver.LDAP.trustCertificates   =
%{idp.authn.LDAP.trustCertificates}
    idp.attribute.resolver.LDAP.searchFilter        =
(uid=$resolutionContext.principal)
    #idp.attribute.resolver.LDAP.searchFilter        = (uid='snahasish')
   idp.attribute.resolver.LDAP.returnAttributes    = ou,uid,mail


2)  attribute-filter.xml

 <AttributeFilterPolicy id="example1">
        <PolicyRequirementRule xsi:type="Requester" value="SP entity ID" />

        <AttributeRule attributeID="eduPersonPrincipalName">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="uid">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="ou">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

    </AttributeFilterPolicy>

3) attribute-resolver-ldap.xml

 <AttributeDefinition id="uid" xsi:type="Simple" sourceAttributeID="uid">
        <Dependency ref="myLDAP" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:uid" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid"
encodeType="false" />
    </AttributeDefinition>
    <AttributeDefinition xsi:type="Simple" id="organizationalUnit"
sourceAttributeID="ou">
        <Dependency ref="myLDAP" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:ou" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.11"
friendlyName="ou" encodeType="false" />
    </AttributeDefinition>
    <AttributeDefinition id="mail" xsi:type="Simple"
sourceAttributeID="mail">
        <Dependency ref="myLDAP" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:mail" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"
encodeType="false" />
    </AttributeDefinition>

Is their any other configuration which I am missing. My aim to return all
value which I mentioned in idp.attribute.resolver.LDAP.returnAttributes
key.

Please help....


On Wed, Nov 22, 2017 at 6:31 PM, Alan Buxey <alan.buxey at myunidays.com>
wrote:

> better. now check the mailing list for that error and what the usual
> causes of it are (is your IdP configured to allow unverified RPs etc?) -
> your error logs will also reveal info
>
> alan
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Snahasish Ghosh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171123/b219bbef/attachment.html>