Trying to setup Shibboleth for Google Apps for Education

[Tim Murphy]

On 25/03/2019 16:57, Melvin Lasky wrote:
> Turns out whatever changes I made for Google completely broke my shib 
> instance.
> 
> Going to revert.
> 
> Any help would be awesome!

Hi Mel,

Regarding breaking your shibboleth instead, please check your logs

Here's an example that I have tested, make sure to change the attributes 
as required. The NameIDFormat I used was emailAddress as I'm not 
scripting it:


metadata/google-metadata.xml:

     <EntityDescriptor entityID="google.com" 
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
         <SPSSODescriptor 
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
             <AssertionConsumerService index="1" 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
             Location="https://www.google.com/a/yourdomain.tld/acs" />
         </SPSSODescriptor>
     </EntityDescriptor>



/opt/shibboleth-idp/conf/attribute-resolver.xml

     <AttributeDefinition id="Gprincipal" xsi:type="Simple" 
sourceAttributeID="mail">
         <Dependency ref="myLDAP" />
     </AttributeDefinition>



/opt/shibboleth-idp/conf/attribute-filter.xml

     <!-- G Suite (Google Apps) -->
     <AttributeFilterPolicy id="google.com">
         <PolicyRequirementRule xsi:type="Requester" value="google.com" />
         <AttributeRule attributeID="Gprincipal">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>



/opt/shibboleth-idp/conf/saml-nameid.xml, add Google Apps (within the 
SAML 2 NameID Generation area)

<util:list id="shibboleth.SAML2NameIDGenerators">

.
.
.
.

         <!-- NameID for Google Apps -->
         <bean parent="shibboleth.SAML2AttributeSourcedGenerator"

p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
             p:attributeSourceIds="#{ {'Gprincipal'} }" >
             <property name="activationCondition" >
                  <bean parent="shibboleth.Conditions.RelyingPartyId" 
c:candidate="google.com" />
             </property>
         </bean>
.
.
.
.

     </util:list>