SAManage with Shibboleth 3?

[Mark Cairney]

Hi,

As suggested I stripped the config I'd added for this SP and started
adding it back piece-by-piece:

First of all I confirmed that signing worked with no additional config
in relying-party.xml or saml-nameid.xml.

This broke the NameID addition but I expect this.

Having confirmed this I added the saml-nameid.xml config back in and a
nameID rule to the relying-party.xml.

Finally I disabled encryption of the nameID and the assertion and it worked:

My final relying-party.xml config is:

    <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
      <property name="profileConfigurations">
        <list>
          <bean parent="SAML2.SSO" p:encryptNameIDs="never"
p:encryptAssertions="never"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
        </list>
      </property>
    </bean>

This isn't wildly different from the original config I had in place so
I'm still a bit puzzled why that didn't work:

     <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
         <property name="profileConfigurations">
             <list>
               <bean parent="SAML2.SSO" p:encryptAssertions="never"
p:signAssertions="always" p:encryptNameIDs="never"
p:signResponses="always"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
             </list>
         </property>
     </bean>


Everything else is as it was.

Kind regards,
Mark

On 17/04/18 13:22, Tom Scavo wrote:
> On Tue, Apr 17, 2018 at 4:54 AM, Mark Cairney <Mark.Cairney at ed.ac.uk> wrote:
>>
>> I've added that to the SPSSODescriptor field in the metadata as suggested.
>>
>> That's changed the output of the response a bit but I still don't see
>> any signatures or certificates in the SAML trace. I've also adjusted the
>> relying-party.xml config to have "SignAssertions=always" and
>> "SignResponses=always"
> 
> You should undo all of that since it is not the problem
> 
>> <?xml version="1.0" encoding="UTF-8"?>
>> <saml2p:Response ...
> 
> You're right, neither the response nor the assertion is assigned. Your
> IdP is apparently misconfigured, at least for this SP. Whatever you've
> done, you need to undo it and start from scratch.
> 
> Tom
> 

-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.