Getting PowerFAIDS NetPartner to work with Shibboleth 3

[Daudt, Carl]

Well, I finally got Shibboleth SSO working for Net Partner.  Thank you all for assisting, especially Tony.  I will perform some clean up of my configs and provide a summary.

The most recent issue was fixed by changing where I specified the NameIDFormat, which I had in the Net Partner metadata file.  I had the following:

--- metadata ---
<EntityDescriptor entityID="NetPartner"
                xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
        <SPSSODescriptor
            protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
            urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Location="https://myfapprd.taylor.edu/NetPartnerStudent/Logon.aspx"/>
        </SPSSODescriptor>
</EntityDescriptor>

The change that got Net Partner SSO working for was removing the sixth line (i.e., the <NameIDFormat> specification from the metadata file.  Instead, I placed the specification as a nameIDFormatPrecedence entry in reying-party.xml as follows:

--- NetPartner entry for relying-party.xml ---
        <bean parent="RelyingPartyByName" c:relyingPartyIds="NetPartner">
            <property name="profileConfigurations">
                <list>
                    <bean parent="Shibboleth.SSO" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML1.AttributeQuery" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML1.ArtifactResolution" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.ECP" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.Logout" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.AttributeQuery" p:securityConfiguration-ref="SHA1SecurityConfig" />
                    <bean parent="SAML2.ArtifactResolution" p:securityConfiguration-ref="SHA1SecurityConfig" />
                                    <bean parent="SAML2.SSO"
                                                p:encryptAssertions="false"
                                                p:securityConfiguration-ref="SHA1SecurityConfig"
                                                p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'}}"
                                     />
                </list>
            </property>
        </bean>

I admit to being confused why this change worked-it seems like it should have worked in my metadata file.

In response to Peter's suggestion that I "...avoid using the 'unspecified' (nameid-format) if at all possible", I tried another value, only to have things break for me.  It seems that the 'unspecified' settings is what works here.

Again, I will post a summary of all of my Shibboleth and Net Partner configs for supporting PowerFAIDS Net Partner SSO.  This might take me a couple days or so.

Carl


The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180515/592d6378/attachment.html>