Getting PowerFAIDS NetPartner to work with Shibboleth 3
Tony Skalski
ajs at stolaf.edu
Fri May 11 12:41:48 EDT 2018
Hi Carl,
We've had NetPartner working for some time. My configuration notes says
that NetPartner requires the NameID to be an email address but in
unspecified format, because this is the match field to records in the
back-end database. (I don't recall if this is a specific requirement or
just that we specify email address as the match field in NP Manager (I
don't have access to NP Manager config at the moment)). So this may or may
not effect your use of the "Spriden ID" as the NameID.
In NP Manager we set the protocol binding to POST but the IdP URL to
https://login.stolaf.edu/idp/profile/SAML2/Redirect/SSO which seems to jibe
with your config.
I do notice one difference in our configs: in our relying part override, we
have set "p:securityConfiguration-ref="SHA1SecurityConfig". IIRC, when we
upgraded to v3, NetPartner did not work until we added that line. Here are
our relevant config bits:
metadata:
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="NetPartner">
<md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
<md:AssertionConsumerService index="1" isDefault="true"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://blah.stolaf.edu/NetPartner/NetPartnerStudent/Logon.aspx" />
</md:SPSSODescriptor>
</md:EntityDescriptor>
relying-party.xml:
<!-- Some SPs need nameid to be email address in
format:unspecified. -->
<bean parent="RelyingPartyByName" c:relyingPartyIds="#{{
'NetPartner',
'***.***.***',
'****.***.***'
}}">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO"
p:encryptAssertions="false"
p:encryptNameIDs="false"
p:securityConfiguration-ref="SHA1SecurityConfig"
p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified'}}"
/>
<ref bean="SAML2.Logout" />
</list>
</property>
</bean>
On Fri, May 11, 2018 at 10:29 AM Daudt, Carl <crdaudt at taylor.edu> wrote:
> OK, I now have the following for my relying-part.xml configuration, which
> is getting me a lot further:
>
> ---BEGIN---
>
> <bean parent="RelyingPartyByName" c:relyingPartyIds="NetPartner">
>
> <property name="profileConfigurations">
>
> <list>
>
> <bean parent="SAML2.SSO"
>
>
> p:encryptAssertions="false"
>
> />
>
> </list>
>
> </property>
>
> </bean>
>
> ---END---
>
>
>
> My metadata is unchanged.
>
>
>
> I am properly redirected to my CAS login screen (our Shibboleth
> configuration uses CAS for logins), and then I am redirected back to
> NetPartner, albeit with an “Invalid Single Sign On Response” message, which
> I will explain below.
>
>
>
> My shibboleth logs end with the following entry:
>
> ---BEGIN---
>
> 2018-05-11 10:38:59,599 - INFO [Shibboleth-Audit.SSO:241] -
> 20180511T143859Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|dcdgnhncfmpgmahebjiejlpbekfpgjmadbofekpb|NetPartner|
> http://shibboleth.net/ns/profiles/saml2/sso/browser|https://myshibbolethserver.myuniversity.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2062f2d7c57e755b95757862a95dceab|crdaudt|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|netPartnerStudentID|AAdzZWNyZXQxYmLfPXBwREDYO4i78NsYwsnyDjrHRmXo+MXbxn5A2zzz4beCrAbfyrwNsPEbV04NSTKmJ6yIoVBFAizssJI3Dm6QhfxajQGO2ERY+iZ5d9Y=|_dc25b38190cd8aa953c635901fe5ab80|
> <http://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://myshibbolethserver.myuniversity.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_2062f2d7c57e755b95757862a95dceab%7Ccrdaudt%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7CnetPartnerStudentID%7CAAdzZWNyZXQxYmLfPXBwREDYO4i78NsYwsnyDjrHRmXo+MXbxn5A2zzz4beCrAbfyrwNsPEbV04NSTKmJ6yIoVBFAizssJI3Dm6QhfxajQGO2ERY+iZ5d9Y=%7C_dc25b38190cd8aa953c635901fe5ab80%7C>
>
> ---END---
>
>
>
> My Net Partner logs indicate an ERROR that “SSO Response Digital Signature
> could not be validated”.
>
>
>
> In my Net Partner configuration, I have specified that the Public Key
> Certificate” for my IdP is my idp-encryption.crt file (I have also tried
> idp-signing.crt – to be honest, I am not sure which to use). I have also
> specified that my IdP URL is
> https://myshibbolethserver.myuniversity.edu/idp/profile/SAML2/Redirect/SSO
> , my Protocol Binding is POST, and my Requested NameId Format is
> unspecified (other options include persistent, transient, emailAdress, and
> various other options).
>
>
>
> Any further suggestions?
>
>
>
> *Carl R. Daudt*
>
> Enterprise Applications Systems Analyst, Information Technology
>
> Taylor University
> 236 W. Reade Avenue
> Upland, IN 46989
> Office: 765-998-5313
>
> crdaudt at taylor.edu
>
>
>
>
> The information in this communication is intended solely for the
> individual or entity to whom it is addressed. It may contain confidential
> or legally privileged information. If you are not the intended recipient,
> any disclosure, copying, distribution or reliance on the contents of this
> information is strictly prohibited, and may be unlawful. If you have
> received this communication in error, please notify us immediately by
> responding to the sender of this email, and then delete it from your
> system. Taylor University is not liable for the inaccurate or improper
> transmission of the information contained in this communication or for any
> delay in its receipt.
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
--
*Tony Skalski*
System Administrator | IT
*Office: *507-786-3227 <javascript:void(0);>
1510 St. Olaf Avenue Northfield, MN 55057
stolaf.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180511/1dc4911c/attachment.html>
More information about the users
mailing list