Access issue with some publisher platforms

[Francis Jayakanth]

Thank you, Peter, for the detailed reply. I will explore them.

Initially, when we set up the federated access, we were using the on-premises AD for authentication, and everything worked fine with all the publishers' platforms. Recently, we had to switch to the Azure AD for authentication, and since then, we are having an issue with some of the publishers.

 - Francis
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: 20 February 2021 19:23
To: users at shibboleth.net <users at shibboleth.net>
Subject: Re: Access issue with some publisher platforms

External Email


* Francis Jayakanth via users <users at shibboleth.net> [2021-02-20 14:39]:
> HI, we are using Shibboleth IdP 4.0.1 along with Azure AD tenant

FTR, I don't know what that means or how the "Azure AD tenant" part is
relevant to your Shibboleth IDP federating with those publishers.

> The attributes released from the IdP are: eduPersonEntitlement, eduPersonScopedAffiliation, and eduPersonTargetedID.

Note that many publishers require some sort of set-up process to be
completed. Sometimes that includes configuring exactly what attribute
(and value/s) should be used by the platform for access control, in a
self-service interface accessible only to selected representatives
from the institution.

This will differ for each publisher (which doesn't scale, of course).
E.g. here are some resources for Springer:

https://support.springer.com/en/support/solutions/articles/6000079288-shibboleth-access-for-institutions
and
https://idp.springer.com/help/sso

> The Springer site, link.springer.com throws up an Application error with Issue reference number:
> 1a4582-SAMLmessagevalidationfailedduringSingleSign-On

You'd have to ask Springer Nature what their own error messages mean
in detail. I have not encountered this myself with them so I couldn't say.

If you don't have any contact details for the SP the SAML entity
serving link.springer.com is "https://fsso.springer.com" and REFEDS
MET has dozens of entries for that entity, most of which providing
contact details:
https://met.refeds.org/met/search_service/?entityid=https://fsso.springer.com
E.g. my own registration lists "onlineservice at springernature.com" both
for technical and support requests.

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210220/69db7d62/attachment.htm>