Getting PowerFAIDS NetPartner to work with Shibboleth 3

[Tony Skalski]

In your activationCondition, I think you want the value to be the
NetPartner EntityId, which is simply "NetPartner".

ajs

On Mon, May 14, 2018 at 10:32 AM Daudt, Carl <crdaudt at taylor.edu> wrote:

> Thanks Tony.  This has brought me beyond the certificate issue that
> presented me with the NetPartner “Invalid Single Sign On Response”
> message.  In fact, I think I am close, but either NetPartner is not
> processing the netPartnerStudentID (an ID from our Banner database), or the
> netPartnerStudentID is not populated with the data I expect.  Based on my
> Shibboleth debug logs, I believe NetPartner is trying to use the wrong
> attribute, because netPartnerStudentID appears to be populated correctly.
>
>
>
> I wonder if I need to configure Shibboleth to use netPartnerStudentID as
> my transient ID?  Tony, perhaps you can help here.
>
>
>
>
>
> Here are relevant error messages, log entries, and Shibboleth
> configurations:
>
>
>
> The error message presented to the user by NetPartner is “Your login
> failed.  We could not validate your netPartnerStudentID”.
>
>
>
> There is no entry recorded in the NetPartner NPStudent.log file (when I
> had certificate issues, there was an error entry in this file).
>
>
>
> --From my Shibboleth idp-process.log, I have the following:
>
> ------ BEGIN id-process.log -------
>
> 2018-05-14 10:55:18,808 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247] -
> Attribute Definition 'netPartnerStudentID': produced an attribute with the
> following values [StringAttributeValue{value=@12345678}]
>
>   (where “@12345678” matches the BannerID for the NetPartner User, as
> identified in the NetPartner “Alternet ID” field that is used for
> NetPartner logins).
>
> --- and ---
>
> 2018-05-14 10:55:19,011 - INFO [Shibboleth-Audit.SSO:241] -
> 20180514T145519Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|llcpcpikeeagmlemdfpnapkbjmimiabncmcipeno|NetPartner|
> http://shibboleth.net/ns/profiles/saml2/sso/browser|https://myshibbolethserver.myuniversity.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e1728
> …677f2b|crdaudt|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|netPartnerStudentID|AAdzZW…H6Hqg=|_13f33…dc545|
>
> ------ END id-process.log -------
>
> Note about the logs above:  I do not know if the fact that both my
> username, “crdaudt”, and a hash for the netPartnerStudentID is being
> retured to the service provider is relevant.
>
>
>
> Here is my configuration in saml-named.xml:
>
> ------ BEGIN ------
>
>                 <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
>
>                                 p:attributeSourceIds="#{
> {'netPartnerStudentID'} }"
>
>                 >
>
>                                 <property name="activationCondition">
>
>                                                 <bean
> parent="shibboleth.Conditions.RelyingPartyId">
>
>
> <constructor-arg name="candidates">
>
>
> <list>
>
>
> <value>https://mynetpartnerserver.myuniversity.edu</value>
>
>
> </list>
>
>
> </constructor-arg>
>
>                                                 </bean>
>
>                                 </property>
>
>                 </bean>
>
> ------ END ------
>
>
>
> Any thoughts?
>
>
>
>
>
> *Carl R. Daudt*
>
> Enterprise Applications Systems Analyst, Information Technology
>
> Taylor University
> 236 W. Reade Avenue
> Upland, IN  46989
> Office:  765-998-5313
>
> crdaudt at taylor.edu
>
>
>
>
> The information in this communication is intended solely for the
> individual or entity to whom it is addressed. It may contain confidential
> or legally privileged information. If you are not the intended recipient,
> any disclosure, copying, distribution or reliance on the contents of this
> information is strictly prohibited, and may be unlawful. If you have
> received this communication in error, please notify us immediately by
> responding to the sender of this email, and then delete it from your
> system. Taylor University is not liable for the inaccurate or improper
> transmission of the information contained in this communication or for any
> delay in its receipt.
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
*Tony Skalski*
System Administrator | IT

*Office: *507-786-3227 <javascript:void(0);>
1510 St. Olaf Avenue Northfield, MN 55057
stolaf.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180514/17d9a6d0/attachment.html>