SAManage with Shibboleth 3?

[Mark Cairney]

Hi,

Does anyone use Samanage.com with Shibboleth 3? I've been asked to
enable it for our IdP and it seems to be far from standard.

Warning sign #1 was the lack of signing and encryption keys in their
metadata, warning sign #3 was their use of NameIDs :-)

I've been following what little documentation there is available (it's
all for Shib 2 rather than Shib 3) and I think the config is correct at
this end but it's still not working and they are now claiming "we need
us to send an x509 certificate with the request" which doesn't make a
lot of sense to me if I'm honest particularly since one of the sets of
docs says to disable encryption and signing.

The docs I've been following are:
https://community.samanage.com/message/6116
and
https://wiki.shibboleth.net/confluence/display/SHIB2/SAManage

The SAManage specific parts of my config are currently:

metadata-providers.xml:
      <MetadataProvider id="Samanage"  xsi:type="FilesystemMetadataProvider"
                metadataFile="%{idp.home}/metadata/samanage-metadata.xml"/>

relying-party.xml:
     <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
        <property name="profileConfigurations">
            <list>
              <bean parent="SAML2.SSO" p:encryptAssertions="never"
p:signAssertions="always" p:encryptNameIDs="never"
p:signResponses="always"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
            </list>
        </property>
    </bean>

attribute-resolver.xml:
        <!-- Separate mail attribute for SAManage to be sent as nameid -->
    <resolver:AttributeDefinition id="samanagemail" xsi:type="ad:Simple"
sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />
          <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
    </resolver:AttributeDefinition>

attribute-filter.xml:
    <afp:AttributeFilterPolicy id="SAMAnage">
    <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="SAManage.com"/>
   <afp:AttributeRule attributeID="samanagemail">
      <afp:PermitValueRule xsi:type="basic:ANY"/>
   </afp:AttributeRule>
  </afp:AttributeFilterPolicy>

saml-namedid.xml

        <!-- NameID entry for SAManage -->
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:omitQualifiers="true"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="samanagemail">

        <property name="activationCondition">
            <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="SAManage.com" />
        </property>
        </bean>

Can anyone spot any obvious issues with what I've entered above?
-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.