Getting PowerFAIDS NetPartner to work with Shibboleth 3

[Daudt, Carl]

Thanks Tony.  This has brought me beyond the certificate issue that presented me with the NetPartner "Invalid Single Sign On Response" message.  In fact, I think I am close, but either NetPartner is not processing the netPartnerStudentID (an ID from our Banner database), or the netPartnerStudentID is not populated with the data I expect.  Based on my Shibboleth debug logs, I believe NetPartner is trying to use the wrong attribute, because netPartnerStudentID appears to be populated correctly.

I wonder if I need to configure Shibboleth to use netPartnerStudentID as my transient ID?  Tony, perhaps you can help here.


Here are relevant error messages, log entries, and Shibboleth configurations:

The error message presented to the user by NetPartner is "Your login failed.  We could not validate your netPartnerStudentID".

There is no entry recorded in the NetPartner NPStudent.log file (when I had certificate issues, there was an error entry in this file).

--From my Shibboleth idp-process.log, I have the following:
------ BEGIN id-process.log -------
2018-05-14 10:55:18,808 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247] - Attribute Definition 'netPartnerStudentID': produced an attribute with the following values [StringAttributeValue{value=@12345678}]
  (where "@12345678" matches the BannerID for the NetPartner User, as identified in the NetPartner "Alternet ID" field that is used for NetPartner logins).
--- and ---
2018-05-14 10:55:19,011 - INFO [Shibboleth-Audit.SSO:241] - 20180514T145519Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|llcpcpikeeagmlemdfpnapkbjmimiabncmcipeno|NetPartner|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://myshibbolethserver.myuniversity.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e1728...677f2b|crdaudt|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|netPartnerStudentID|AAdzZW...H6Hqg=|_13f33...dc545|
------ END id-process.log -------
Note about the logs above:  I do not know if the fact that both my username, "crdaudt", and a hash for the netPartnerStudentID is being retured to the service provider is relevant.

Here is my configuration in saml-named.xml:
------ BEGIN ------
                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                                p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
                                p:attributeSourceIds="#{ {'netPartnerStudentID'} }"
                >
                                <property name="activationCondition">
                                                <bean parent="shibboleth.Conditions.RelyingPartyId">
                                                                <constructor-arg name="candidates">
                                                                                <list>
                                                                                                <value>https://mynetpartnerserver.myuniversity.edu</value>
                                                                                </list>
                                                                </constructor-arg>
                                                </bean>
                                </property>
                </bean>
------ END ------

Any thoughts?


Carl R. Daudt
Enterprise Applications Systems Analyst, Information Technology
Taylor University
236 W. Reade Avenue
Upland, IN  46989
Office:  765-998-5313
crdaudt at taylor.edu<mailto:crdaudt at taylor.edu>



The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180514/912f3868/attachment.html>