Getting PowerFAIDS NetPartner to work with Shibboleth 3

[Daudt, Carl]

Uggh, I think I am close, but am still getting the same error from NetPartner:  "Your login failed. We could not validate your User Name."
Any new ideas?

Here is a recap:  Here is what I have for Shib:

Your assistance is greatly appreciated!!

--- metadata ---
<EntityDescriptor entityID="NetPartner"
                xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
        <SPSSODescriptor
            protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
            urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Location="https://myfapprd.taylor.edu/NetPartnerStudent/Logon.aspx"/>
        </SPSSODescriptor>
</EntityDescriptor>

--- attribute-resolver.xml ---
    <resolver:AttributeDefinition xsi:type="Simple" id="netPartnerStudentID" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="SpriIdAlias">
        <resolver:Dependency ref="mySIS2" />
        <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
        <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:TransientId" id="transientId">
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
    </resolver:AttributeDefinition>

--- attribute-filter.xml ---
    <AttributeFilterPolicy id="releaseForNetPartnerSP">
        <PolicyRequirementRule xsi:type="Requester" value="NetPartner" />
        <AttributeRule attributeID="netPartnerStudentID">
            <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>
    </AttributeFilterPolicy>

--- relying-party.xml ---
        <bean parent="RelyingPartyByName" c:relyingPartyIds="NetPartner">
            <property name="profileConfigurations">
                <list>
                    <bean parent="Shibboleth.SSO" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML1.AttributeQuery" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML1.ArtifactResolution" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.ECP" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.Logout" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.AttributeQuery" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.ArtifactResolution" p:securityConfiguration-ref="SHA1SecurityConfig" />
                                    <bean parent="SAML2.SSO"
                                                p:encryptAssertions="false"
                                                p:securityConfiguration-ref="SHA1SecurityConfig"
                                     />
                </list>
            </property>
        </bean>

--- saml-nameid.xml ---
                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                                p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
                                p:attributeSourceIds="#{ {'netPartnerStudentID'} }"
                >
                                <property name="activationCondition">
                                                <bean parent="shibboleth.Conditions.RelyingPartyId">
                                                                <constructor-arg name="candidates">
                                                                                <list>
                                                                                                <value>NetPartner</value>
                                                                                </list>
                                                                </constructor-arg>
                                                </bean>
                                </property>
                </bean>

The Shibboleth idp-process.log file shows (with debug turned on) that the attribute netPartnerStudentID has a value of @12345678 (numerical value reported here is modified for security), and is released to NetPartner.
In NetPartner, the same value is set for both the Alternate ID and Web ID for a test student to @12345678.  When NetPartner is configured for regular login, I can log in for that user.  But when I set NetPartner for SAML Single Sign on, I get the error above.



Carl R. Daudt
Enterprise Applications Systems Analyst, Information Technology
Taylor University
236 W. Reade Avenue
Upland, IN  46989
Office:  765-998-5313
crdaudt at taylor.edu<mailto:crdaudt at taylor.edu>



The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180514/7cff6205/attachment.html>