SAManage with Shibboleth 3?

[Mark Cairney]

Hi,


The nameID release appears to be working as-is:

20180416T142441Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_bc64381f-c438-45bc-8a49-0cadd9cabca1|SAManage.com|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp-test.ucs.ed.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f0b78cba8668e85dbfa56ac678a6cd1e|mcairney|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|samanagemail,transientId|Mark.Cairney@ed.ac.uk|_c03102f3f912aeb846a4c32bea59be6d

The issue seems to be that they expect a certificate to be sent during 
the transaction

 From the information I've received from the user:

"
Hello,
This link would show what visible in your instance's metada:
https://edin.samanage.com/saml/metadata.  However, as mentioned 
previously we are looking for the token signing certificate to be 
included in the saml request as it would be compared with the 
certificate you have pasted under Setup -> SSO for validity.
"

Does this make sense to you given they themselves don't provide any 
certificates for signing/encryption (the metadata file they provided is 
literally 4 lines of XML!) and the only certificates I'm aware of that 
are routinely transferred during a SAML conversation are one or more of 
these? Also at least one piece of the few bits of documentation say to 
disable encryption and signing?
I was under the impression that signing/encryption had to be mutually 
declared between both parties?

On 16/04/18 17:01, Peter Schober wrote:
> * Mark Cairney <Mark.Cairney at ed.ac.uk> [2018-04-16 15:47]:
>> The docs I've been following are:
>> https://community.samanage.com/message/6116
>> and
>> https://wiki.shibboleth.net/confluence/display/SHIB2/SAManage
>  From those two I gather that your question actually is:
> How do I release the subject's email address as an emailAddress-format
> NameID in Shibboleth IDPv3?
>
>> relying-party.xml:
>>       <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
>>          <property name="profileConfigurations">
>>              <list>
>>                <bean parent="SAML2.SSO" p:encryptAssertions="never"
>> p:signAssertions="always" p:encryptNameIDs="never"
>> p:signResponses="always"
>> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
>>              </list>
>>          </property>
>>      </bean>
> FYI, you can drop p:nameIDFormatPrecedence from there and instead
> simply add that format as the first (or only) NameIDFormat element to
> the locally-managed SAML metadata you load from
> %{idp.home}/metadata/samanage-metadata.xml
>
>> attribute-resolver.xml:
> No need to touch the resolver for IDPv3. Instead just add this to your
> conf/saml-nameid.xml (and remove your previous attempts while you#re
> there) to the util:list with id="shibboleth.SAML2NameIDGenerators":
>
>    <!-- email as NameID -->
>    <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>        p:omitQualifiers="true"
>        p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>        p:attributeSourceIds="#{ {'mail'} }" />
>
> and release the 'mail' attribute to the SP in your
> attribute-filter.xml, as usual.
>
> Done.
>
> -peter

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180416/d1ef75f7/attachment.html>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20180416/d1ef75f7/attachment.ksh>