Anyone have any success setting up with Starfishsolutions?

[Melvin Lasky]

Hey all,
	We are trying to implement Shibboleth with Starfishsolutions…..

We are continuing to get a 

You do not have a user account in the Starfish system.

Please contact your system administrator if you should have or would like to gain access to this application.

—

What concerns me is this… In my attribute-filter, I tried as a regex https://*.starfishsolutions.com/* <https://*.starfishsolutions.com/*> etc…. 

<AttributeFilterPolicy id="releaseForSTARFISH" >
  <PolicyRequirementRule xsi:type="RequesterRegex" regex="https:\/\/.*\.starfishsolutions\.com\/.*\/.*" /> 
  <AttributeRule attributeID="eduPersonPrincipalName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="displayName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="mail">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
   <AttributeRule attributeID="surname">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="givenName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="eduPersonAffiliation">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="uid">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
</AttributeFilterPolicy>

Didn’t work. I also tried this:

<AttributeFilterPolicy id="releaseForSTARFISH" >
  <PolicyRequirementRule xsi:type="Requester" value="urn:saml:starfishsolutions:v1:manhattan-test_starfish-sp-2019-2024-production" /> 
  <AttributeRule attributeID="eduPersonPrincipalName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="displayName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="mail">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
   <AttributeRule attributeID="surname">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="givenName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="eduPersonAffiliation">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="uid">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
</AttributeFilterPolicy>

Both have same result

When I look at the logs, what I notice is this:

shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2019-05-07 13:36:47,435 - INFO [Shibboleth-Audit.SSO:275] - 20190507T133647Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|a1gd9hb4b8cahc0f4e775c0778fa6i4|urn:saml:starfishsolutions:v1:manhattan-test_starfish-sp-2019-2024-production|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://ourshibbolethserver.manhattan.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_c9c7ed626a291e8be9b328a6a99534e9|melvin.lasky|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,mail,surname,givenName,eduPersonPrincipalName|AAdzZWNyZXQxfzIVftcT7532TD2JqJInMnzix0aGjqTF8d+kGWDuE0G8W+A4fTv5ZKJiHVh8lZE9uLStuOhdU/xcV0yXgTsrDf0wLi4ztNpCbdrZsM9TDJBnTlkDzlK0UiIWOR5crwRSI66OPH176Asy6m6Qx1erS0cHwr6ByRbpjhEMsx+KXl3UpPkELS5DkSAFIIKA/A==|_4fdc3ba871d1cb09e3c521a07eff1e12|

First, I don’t see it coming from an https://* <https://*/> address like my other requests, I see it coming from urn:saml:starfishsolutions:v1:manhattan-test_starfish-sp-2019-2024-production

Also, it looks like it is sending the attributes, but not the ones I selected? uid,mail,surname,givenName,eduPersonPrincipalName

Do you think it’s something on our side or their side? Also, why can’t I get the attributes I listed to be released, and why is it releasing those attributes? Any help will be greatly appreciated.

Thanks

Mel

Melvin Lasky
Associate Director of Enterprise Architecture





Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu <mailto:melvin.lasky at manhattan.edu>
www.manhattan.edu <http://www.manhattan.edu/>




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190507/4a36e26c/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: email_logo.jpg
Type: image/jpeg
Size: 7478 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20190507/4a36e26c/attachment.jpg>