Getting PowerFAIDS NetPartner to work with Shibboleth 3

Daudt, Carl crdaudt at taylor.edu
Tue May 8 16:05:52 EDT 2018 

I realize that others have posted a desire to get PowerFAIDS NetPartner SSO working with Shibboleth's SAML implementation.  In November of 2014, mrahman posted instructions for doing this with Shib 2.4.2, and I recall having this work for me (see http://shibboleth.net/pipermail/users/2014-November/018121.html).  However, I have not had success in implementing NetParter SSO with Shibboleth 3.  Based on my logs (in debug mode), my hangup at present seems to be that "no relying party configurations ae applicable", even though I have the relying party configured.  Following is my idp-process log:

---BEGIN LOG---
2018-05-08 11:27:17,533 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler' on INBOUND message context
2018-05-08 11:27:17,533 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2018-05-08 11:27:17,533 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml1.binding.impl.SAML1ArtifactRequestIssuerHandler' on INBOUND message context
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler' on INBOUND message context
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler' on INBOUND message context
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer NetPartner
2018-05-08 11:27:17,548 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293] - Resolving relying party configuration
...(non relevant lines removed)...
2018-05-08 11:27:17,564 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:305] - Checking if relying party configuration EntityNames[https://mynetpartnerhost.myuniversity.edu,] is applicable
2018-05-08 11:27:17,564 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:310] - Relying party configuration EntityNames[https:// mynetpartnerhost. myuniversity.edu,] is not applicable
2018-05-08 11:27:17,564 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:314] - No relying party configurations are applicable, returning the default configuration shibboleth.DefaultRelyingParty
---END LOG---


I added the following bean to my relying-party.xml file to use the Spriden ID (from Banner) for NetPartner:

---BEGIN BEAN---
        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://mynetpartnerhost.myuniversity.edu">
            <property name="profileConfigurations">
                <list>
                        <bean parent="SAML2.SSO"
                                p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
                                p:encryptNameIDs="false"
                                p:encryptAssertions="false"
                        />
                </list>
            </property>
        </bean>
---END BEAN---


The following is my metadata file for netpartner:

---BEGIN METADATA---
<EntityDescriptor entityID="NetPartner"
        xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
        <SPSSODescriptor
            protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://mynetpartnerhost.myuniversity.edu/NetPartnerStudent/Logon.aspx"/>
        </SPSSODescriptor>
</EntityDescriptor>
---END METADATA---


I can provide additional configurations and/or complete files if helpful.  Any ideas?

By the way, if I can get NetPartner working with Shibboleth IdP v3, I will be happy to post results.




Carl R. Daudt
Enterprise Applications Systems Analyst, Information Technology
Taylor University
236 W. Reade Avenue
Upland, IN  46989
Office:  765-998-5313
crdaudt at taylor.edu<mailto:crdaudt at taylor.edu>



The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180508/b8499bae/attachment.html>

More information about the users mailing list