SAManage with Shibboleth 3?

[Mark Cairney]

It's a Test IdP we use for staging integrations and ironing out issues
like this before loading it into our production IdP.

We are using filebackedHTTPproviders for a number of other SPs (e.g.
Office365 which does change it's keys regularly).

The point about key rollover is moot in this case as their metadata has
no keys and I've had to manually hack the endpoint URLs in the metadata
to work around an issue with how their website is hosted.

The downloaded metadata already contains a NameIDFormat element:

  <md:NameIDFormat>
   urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
  </md:NameIDFormat>

I do like the look of the NameIDFormatFilter and Predicate filter
although I note that this is new functionality.



On 18/04/18 15:55, Tom Scavo wrote:
> On Wed, Apr 18, 2018 at 9:35 AM, Peter Schober
> <peter.schober at univie.ac.at> wrote:
>> * Mark Cairney <Mark.Cairney at ed.ac.uk> [2018-04-18 14:25]:
>>> My final relying-party.xml config is:
>>>
>>>     <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
>>>       <property name="profileConfigurations">
>>>         <list>
>>>           <bean parent="SAML2.SSO" p:encryptNameIDs="never"
>>> p:encryptAssertions="never"
>>> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
>>>         </list>
>>>       </property>
>>>     </bean>
>>>
>>> This isn't wildly different from the original config I had in place
>>
>> Which is why my earlier comment about nameIDFormatPrecedence still
>> applies. (TL;DR: Put it in metadata instead.)
> 
> Yes, I agree, put it in the metadata, but let's back up a bit. Mark,
> in your original post, you said you're using a
> FilesystemMetadataProvider on a snapshot of SP metadata. I wonder why
> you did it that way?
> 
> Looking at the external doc you provided earlier, [1] I see that SP
> metadata can be retrieved via HTTPS. Is that correct? If so, you might
> want to do the following:
> 
> 1. Configure a FileBackedHTTPMetadataProvider [2]
> 2. Add a NameIDFormat filter [3]
> 3. Add a Predicate filter [4]
> 
> The latter is used to limit metadata to a single SP, that is, your SP
> and no others.
> 
> Hope this helps,
> 
> Tom
> 
> [1] https://community.samanage.com/message/6116
> [2] https://wiki.shibboleth.net/confluence/x/kQInAQ
> [3] https://wiki.shibboleth.net/confluence/x/bwCIAQ
> [4] https://wiki.shibboleth.net/confluence/x/aAAzAQ
> 

-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.