Getting PowerFAIDS NetPartner to work with Shibboleth 3

[Tony Skalski]

In NetPartner Manager, on the Login tab, is the "Students login using" set
to either the Alternate ID or Web ID? We use email1 because we are sending
an email as a NameID (using format unspecified - of course!).

Don't suppose there are any clues in the NPStudent.log...



On Mon, May 14, 2018 at 4:07 PM Daudt, Carl <crdaudt at taylor.edu> wrote:

> Uggh, I think I am close, but am still getting the same error from
> NetPartner:  “Your login failed. We could not validate your User Name.”
>
> Any new ideas?
>
>
>
> Here is a recap:  Here is what I have for Shib:
>
>
>
> Your assistance is greatly appreciated!!
>
>
>
> --- metadata ---
>
> <EntityDescriptor entityID="NetPartner"
>
>                 xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
>
>         <SPSSODescriptor
>
>
> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
>
>             urn:oasis:names:tc:SAML:1.1:protocol
> urn:oasis:names:tc:SAML:1.0:protocol">
>
>
> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
>
>         <AssertionConsumerService index="1"
>
>             Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>
>                     Location="
> https://myfapprd.taylor.edu/NetPartnerStudent/Logon.aspx"/>
>
>         </SPSSODescriptor>
>
> </EntityDescriptor>
>
>
>
> --- attribute-resolver.xml ---
>
>     <resolver:AttributeDefinition xsi:type="Simple"
> id="netPartnerStudentID" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
> sourceAttributeID="SpriIdAlias">
>
>         <resolver:Dependency ref="mySIS2" />
>
>         <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
>
>         <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
>
>     </resolver:AttributeDefinition>
>
>
>
>     <resolver:AttributeDefinition xsi:type="ad:TransientId"
> id="transientId">
>
>         <resolver:AttributeEncoder
> xsi:type="enc:SAML1StringNameIdentifier"
> nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />
>
>         <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
>
>     </resolver:AttributeDefinition>
>
>
>
> --- attribute-filter.xml ---
>
>     <AttributeFilterPolicy id="releaseForNetPartnerSP">
>
>         <PolicyRequirementRule xsi:type="Requester" value="NetPartner" />
>
>         <AttributeRule attributeID="netPartnerStudentID">
>
>             <PermitValueRule xsi:type="ANY"/>
>
>         </AttributeRule>
>
>     </AttributeFilterPolicy>
>
>
>
> --- relying-party.xml ---
>
>         <bean parent="RelyingPartyByName" c:relyingPartyIds="NetPartner">
>
>             <property name="profileConfigurations">
>
>                 <list>
>
>                     <bean parent="Shibboleth.SSO"
> p:securityConfiguration-ref="SHA1SecurityConfig" />
>
>                     <bean parent="SAML1.AttributeQuery"
> p:securityConfiguration-ref="SHA1SecurityConfig" />
>
>                     <bean parent="SAML1.ArtifactResolution"
> p:securityConfiguration-ref="SHA1SecurityConfig" />
>
>                     <bean parent="SAML2.ECP"
> p:securityConfiguration-ref="SHA1SecurityConfig" />
>
>                     <bean parent="SAML2.Logout"
> p:securityConfiguration-ref="SHA1SecurityConfig" />
>
>                     <bean parent="SAML2.AttributeQuery"
> p:securityConfiguration-ref="SHA1SecurityConfig" />
>
>                     <bean parent="SAML2.ArtifactResolution"
> p:securityConfiguration-ref="SHA1SecurityConfig" />
>
>                                     <bean parent="SAML2.SSO"
>
>                                                 p:encryptAssertions="false"
>
>
> p:securityConfiguration-ref="SHA1SecurityConfig"
>
>                                      />
>
>                 </list>
>
>             </property>
>
>         </bean>
>
>
>
> --- saml-nameid.xml ---
>
>                 <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>
> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
>
>                                 p:attributeSourceIds="#{
> {'netPartnerStudentID'} }"
>
>                 >
>
>                                 <property name="activationCondition">
>
>                                                 <bean
> parent="shibboleth.Conditions.RelyingPartyId">
>
>
> <constructor-arg name="candidates">
>
>
> <list>
>
>
> <value>NetPartner</value>
>
>
> </list>
>
>
> </constructor-arg>
>
>                                                 </bean>
>
>                                 </property>
>
>                 </bean>
>
>
>
> The Shibboleth idp-process.log file shows (with debug turned on) that the
> attribute netPartnerStudentID has a value of @12345678 (numerical value
> reported here is modified for security), and is released to NetPartner.
>
> In NetPartner, the same value is set for both the Alternate ID and Web ID
> for a test student to @12345678.  When NetPartner is configured for regular
> login, I can log in for that user.  But when I set NetPartner for SAML
> Single Sign on, I get the error above.
>
>
>
>
>
>
>
> *Carl R. Daudt*
>
> Enterprise Applications Systems Analyst, Information Technology
>
> Taylor University
> 236 W. Reade Avenue
> Upland, IN  46989
> Office:  765-998-5313
>
> crdaudt at taylor.edu
>
>
>
>
> The information in this communication is intended solely for the
> individual or entity to whom it is addressed. It may contain confidential
> or legally privileged information. If you are not the intended recipient,
> any disclosure, copying, distribution or reliance on the contents of this
> information is strictly prohibited, and may be unlawful. If you have
> received this communication in error, please notify us immediately by
> responding to the sender of this email, and then delete it from your
> system. Taylor University is not liable for the inaccurate or improper
> transmission of the information contained in this communication or for any
> delay in its receipt.
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
*Tony Skalski*
System Administrator | IT

*Office: *507-786-3227
1510 St. Olaf Avenue Northfield, MN 55057
stolaf.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180514/a54bec21/attachment.html>