Trying to setup Shibboleth for Google Apps for Education

Tue Mar 26 09:35:17 EDT 2019

Ok I got a little further but any help will be awesome…..

Attribute-filter.xml

<!-- G Suite (Google Apps) -->
<AttributeFilterPolicy id="google.com/a/gtest.manhattan.edu <http://google.com/a/gtest.manhattan.edu>">
   <PolicyRequirementRule xsi:type="Requester" value="google.com/a/gtest.manhattan.edu <http://google.com/a/gtest.manhattan.edu>" />
      <AttributeRule attributeID="Gprincipal">
          <PermitValueRule xsi:type="ANY" />
      </AttributeRule>
</AttributeFilterPolicy>

metadata-providers.xml

    <MetadataProvider id="GTEST"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/gtest-metadata.xml"/>

attribute-resolver.xml

    <AttributeDefinition id="Gprincipal" xsi:type="Simple" sourceAttributeID="mail">
       <Dependency ref="myLDAP" />
    </AttributeDefinition>

saml-nameid.xml

       <!-- NameID for Google Apps -->
       <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
           p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
           p:attributeSourceIds="#{ {'Gprincipal'} }" >
           <property name="activationCondition" >
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="google.com <http://google.com/>" />
           </property>
       </bean>

gtest-metadata.xml

<EntityDescriptor entityID="google.com/a/gtest.manhattan.edu <http://google.com/a/gtest.manhattan.edu>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
       <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
           <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
           <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
           Location="https://www.google.com/a/gtest.manhattan.edu/acs <https://www.google.com/a/gtest.manhattan.edu/acs>" />
       </SPSSODescriptor>
</EntityDescriptor>

———

Now I’m getting this
This account cannot be accessed because your credentials were not verified.
We are unable to process your request at this time, please try again later.

And in my logs:

shib-idp;idp-process.log;dev;nothing;2019-03-26 13:27:49,949 - WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:257] - Validation failure: Failed to resolve both a data and a key encryption credential
shib-idp;idp-warn.log;dev;nothing;2019-03-26 13:27:49,949 - WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:257] - Validation failure: Failed to resolve both a data and a key encryption credential
shib-idp;idp-process.log;dev;nothing;2019-03-26 13:27:49,958 - WARN [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:339] - Profile Action PopulateEncryptionParameters: Resolver returned no EncryptionParameters
shib-idp;idp-warn.log;dev;nothing;2019-03-26 13:27:49,958 - WARN [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:339] - Profile Action PopulateEncryptionParameters: Resolver returned no EncryptionParameters
shib-idp;idp-process.log;dev;nothing;2019-03-26 13:27:49,964 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidSecurityConfiguration
shib-idp;idp-warn.log;dev;nothing;2019-03-26 13:27:49,964 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidSecurityConfiguration
shib-idp;idp-process.log;dev;nothing;2019-03-26 13:27:50,026 - WARN [org.opensaml.saml.common.binding.SAMLBindingSupport:93] - Relay state exceeds 80 bytes: https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&service=mail&hl=en&ss=1&scc=1&rm=false&checkedDomains=youtube&checkConnection=youtube%3A247%3A1&pstMsg=1&osid=1 <https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&service=mail&hl=en&ss=1&scc=1&rm=false&checkedDomains=youtube&checkConnection=youtube%3A247%3A1&pstMsg=1&osid=1>
shib-idp;idp-warn.log;dev;nothing;2019-03-26 13:27:50,026 - WARN [org.opensaml.saml.common.binding.SAMLBindingSupport:93] - Relay state exceeds 80 bytes: https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&service=mail&hl=en&ss=1&scc=1&rm=false&checkedDomains=youtube&checkConnection=youtube%3A247%3A1&pstMsg=1&osid=1 <https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&service=mail&hl=en&ss=1&scc=1&rm=false&checkedDomains=youtube&checkConnection=youtube%3A247%3A1&pstMsg=1&osid=1>
shib-idp;idp-audit.log;dev;nothing;20190326T132750Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|bigcpgpigfmmknogcdhnhlicmlainaflaoldchfn|google.com/a/gtest.manhattan.edu|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://auth.manhattan.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_227f0cc3fc7294812d00a6652066917c|||||| <http://google.com/a/gtest.manhattan.edu|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://auth.manhattan.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_227f0cc3fc7294812d00a6652066917c||||||>
shib-idp;idp-process.log;dev;nothing;2019-03-26 13:27:50,049 - INFO [Shibboleth-Audit.SSO:275] - 20190326T132750Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|bigcpgpigfmmknogcdhnhlicmlainaflaoldchfn|google.com/a/gtest.manhattan.edu|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://auth.manhattan.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_227f0cc3fc7294812d00a6652066917c|||||| <http://google.com/a/gtest.manhattan.edu|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://auth.manhattan.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_227f0cc3fc7294812d00a6652066917c||||||>

———

Any suggestions will be greatly appreciated.

Melvin Lasky
Associate Director of Enterprise Architecture
Manhattan College
Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu <mailto:melvin.lasky at manhattan.edu>
www.manhattan.edu <http://www.manhattan.edu/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190326/e5ec9a76/attachment.html>