Igloo Software

[Klingenstein, Nate]

Hugo,


They're giving you the ability to specify the precise path to something in the assertion that you want to use for that purpose.  I've never seen that before.


There will be no defaults for Shibboleth since it depends on what you send, but a best practice might be:


Identifier

/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"]/saml:AttributeValue

(eduPersonPrincipalName on the wire)


Same session index


Email

/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:oid:0.9.2342.19200300.100.1.3"]/saml:AttributeValue

(ldap mail on the wire)


First Name

/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:oid:2.5.4.42"]/saml:AttributeValue

(givenName on the wire)


Last Name

/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:oid:2.5.4.4]/saml:AttributeValue

(sn on the wire)

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Hugo Slavia <hugoslavia101 at gmail.com>
Sent: Thursday, January 4, 2018 9:32:17 PM
To: Shib Users
Subject: Re: Igloo Software

Thanks. That was helpful, I set it up for IDP-initiated SSO (the entityID is the home URL for the community).

There are the following fields to fill in the Igloo SAML webform for the response...with the default values listed (changes depending on the IdP selected -- Shibboleth not listed).

What can be the values to insert for Shibboleth? I tried a number of combinations -- including changing to mail, givenName, sn -- but no dice.

Identifier Path
/samlp:Response/saml:Assertion/saml:Subject/saml:NameID

Session Index Path
/samlp:Response/saml:Assertion/saml:AuthnStatement

Email Path
/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="Email"]/saml:AttributeValue

First Name Path
/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="FName"]/saml:AttributeValue

Last Name Path
/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="LName"]/saml:AttributeValue

On Thu, Jan 4, 2018 at 4:10 PM, Tom Scavo <trscavo at gmail.com<mailto:trscavo at gmail.com>> wrote:
On Thu, Jan 4, 2018 at 5:38 PM, Hugo Slavia <hugoslavia101 at gmail.com<mailto:hugoslavia101 at gmail.com>> wrote:
>
> Their instructions are at:
> https://customercare.igloosoftware.com/support/knowledgebase/articles/sso_saml_authentication
>
> But what do I enter on the IdP side of the equation for the metadata?

If the SP doesn't provide metadata, you'll have to provide it yourself.

> Can an IdP-initiated SSO occur without entry in the IdP metadata?

IdP-initiated, SP-initiated, it doesn't matter, the IdP needs metadata
for every SP.

> What about how to
> list which attributes for release?

The SP entityID is in the SP metadata. Presumably attribute release
will be driven by the SP entityID.

Tom
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180105/79bdc1ab/attachment-0001.html>