General Shib IdP install/config help

Thu Feb 28 16:21:34 EST 2019

Matthew and Scott,

Thank you so much for the additional help here. That is very insightful.
And yes, Matthew, your assumptions are correct. Having the examples
provided will be great!

MC

Mary-Catherine Martinez

Software Implementation Specialist | InnoSoft Canada Inc.

888.510.3827 ext. 712

mc.martinez at innosoft.ca
www.innosoftfusion.com

On Thu, Feb 28, 2019 at 10:00 AM <users-request at shibboleth.net> wrote:

> Send users mailing list submissions to
>         users at shibboleth.net
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://shibboleth.net/mailman/listinfo/users
> or, via email, send a message with subject or body 'help' to
>         users-request at shibboleth.net
>
> You can reach the person managing the list at
>         users-owner at shibboleth.net
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of users digest..."
>
>
> Today's Topics:
>
>    1. RE: General Shib IdP install/config help (Matthew X. Economou)
>    2. Re: General Shib IdP install/config help (Cantor, Scott)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 27 Feb 2019 12:22:15 -0500
> From: "Matthew X. Economou" <xenophon at irtnog.org>
> To: "Shib Users" <users at shibboleth.net>
> Cc: Eric Weber <eric.weber at innosoft.ca>, Tony Autin
>         <tony.autin at innosoft.ca>
> Subject: RE: General Shib IdP install/config help
> Message-ID:
>         <BABF8C57A778F04791343E560165990823718E at cinip100ntsbs.irtnog.net>
> Content-Type: text/plain;       charset="utf-8"
>
> Mary-Catherine Martinez writes:
>
> > I'm looking for a somewhat user-friendly guide on how to setup a Shib
> > IdP from scratch. We're trying to deploy this via AWS Cognito to manage
> > users/accounts and a Windows/EC2 server on AWS... This is one particular
> > area that we are struggling with:
> >
> https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration
>
> If I understand you correctly, you're deploying a Shibboleth IdP on a
> Windows-based EC2 instance, and you're configuring AWS Cognito to use that
> IdP to authenticate users.
>
> According to the AWS Cognito developer guide (
> https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html),
> you would configure your Shibboleth IdP to consume the AWS SP metadata at
> https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html.
> In my case, I've added the following to my metadata-providers.xml file:
>
> <MetadataProvider
>   metadataURL="https://signin.aws.amazon.com/static/saml-metadata.xml"
>   xsi:type="FileBackedHTTPMetadataProvider"
>   backingFile="%{idp.home}/metadata/d1400bed2d51772ab34da144f5c65222.xml"
>   id="_d1400bed2d51772ab34da144f5c65222"/>
>
> You also need to configure the IdP to release the necessary attributes to
> the Cognito service.  This requires adding several attribute definitions to
> attribute-resolver.xml, such as the following examples from my
> configuration:
>
> <AttributeDefinition xsi:type="Simple" id="AmazonWebServicesIAMRole"
>   sourceAttributeID="aws_role">
>     <Dependency ref="staticAttributes"/>
>     <AttributeEncoder xsi:type="SAML2String" encodeType="false"
>       name="https://aws.amazon.com/SAML/Attributes/Role" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Simple"
> id="AmazonWebServicesIAMRoleSessionName"
>   sourceAttributeID="uid">
>     <Dependency ref="uid"/>
>     <AttributeEncoder xsi:type="SAML2String" encodeType="false"
>       name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Simple"
> id="AmazonWebServicesIAMSessionDuration"
>   sourceAttributeID="aws_session_duration">
>     <Dependency ref="staticAttributes"/>
>     <AttributeEncoder xsi:type="SAML2String" encodeType="false"
>       name="https://aws.amazon.com/SAML/Attributes/SessionDuration" />
> </AttributeDefinition>
>
> Note the "sourceAttributeID" attributes and "Dependency" references.
> These refer to other claims (such as "uid") or to data connectors (such as
> "staticAttributes").  For simplicity's sake, here's an example of a data
> connector that generates static values for the IAM role and session
> duration claims:
>
> <DataConnector id="staticAttributes" xsi:type="Static">
>   <Attribute id="aws_role">
>
> <Value>arn:aws:iam::123:role/MyRole,arn:aws:iam::123:saml-provider/MyIdP</Value>
>   </Attribute>
>   <Attribute id="aws_session_duration">
>     <Value>43200</Value>
>   </Attribute>
> </DataConnector>
>
> It's also possible to generate the necessary values from information
> provided by a data connector, such an an LDAP directory, but I believe this
> requires writing some Java.
>
> Best wishes,
> Matthew
>
> --
> "The lyf so short, the craft so longe to lerne."
>
>
> ------------------------------
>
> Message: 2
> Date: Wed, 27 Feb 2019 17:38:09 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> To: Shib Users <users at shibboleth.net>
> Cc: Eric Weber <eric.weber at innosoft.ca>, Tony Autin
>         <tony.autin at innosoft.ca>
> Subject: Re: General Shib IdP install/config help
> Message-ID: <8892BA3F-AF61-4D2C-9098-CCC0A08D3A5A at osu.edu>
> Content-Type: text/plain; charset="utf-8"
>
> On 2/27/19, 12:22 PM, "users on behalf of Matthew X. Economou" <
> users-bounces at shibboleth.net on behalf of xenophon at irtnog.org> wrote:
>
> > If I understand you correctly, you're deploying a Shibboleth IdP on a
> Windows-based EC2 instance, and you're
> > configuring AWS Cognito to use that IdP to authenticate users.
>
> If the question is specifically about Cognito as an SP, I also documented
> that, it's in the IntegrationGuides section, which I moved recently over to
> the KB space where it won't get confined to the V3 doc space.
>
> https://wiki.shibboleth.net/confluence/display/KB/AmazonCognito
>
> -- Scott
>
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> ------------------------------
>
> End of users Digest, Vol 92, Issue 26
> *************************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190228/476cf5e0/attachment.html>