Shib IdP Proxying to another IdP help

[Brent Goebel]

Hello,

I’m working on having my Shibboleth IdP v4.0.1 absolve to another IdP (let’s call it IdP-NEW) for authentication. Therefore any applications/sites using my Shib-IdP for authentication will now absolve to IdP-NEW for authentication.

I followed this document on how to do this: https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP

Some good progress was made but I hit a wall. When IdP-NEW hands the attributes off to Shib-IdP it appears to get stuck here. It’s not taking these.

The workflow that works:  You go to the URL for the Shibboleth IdP enabled application that then redirects to IdP-NEW IdP for login. Once authentication there happens with the attributes set in the IdP-NEW relying party, we see that being passed back over to Shibboleth IdP. Shibboleth IdP doesn’t appear to be translating or sending those attributes it got from IdP-NEW along over to the application.

I tried doing some additional testing and looking at different documents and haven’t been able to find what is missing. What needs to be done to have the Shib-IdP to accept that attributes from IdP-NEW and then pass those along to the application to complete authentication?

Here are the changes I made to configure and enable it, please let me know what I am missing:


  1.  Uncomment the discoveryFunction and edit the target to match the entityID of IdP-NEW.
…/conf/authn/ saml-authn-config.xml
    <bean id="shibboleth.authn.SAML.discoveryFunction" parent="shibboleth.Functions.Constant"
        c:target={IdP-NEW-entityID} />


  1.  Add attribute filter entry for IdP-NEW


  1.  Add entry to the attribute-resolver. This will transform the uid attribute from the Subject (the filtered data from the incoming assertion) into a proxied-uid attribute for use elsewhere:
                                   <AttributeDefinition xsi:type="SubjectDerivedAttribute"
                                      forCanonicalization="true"
principalAttributeName="uid"  id="proxied-uid"  />



  1.  Set the AttributesToResolve in c14n/attribute-sourced-subject-c14n-config.xml to the 'proxied-uid' attribute created.  Added a AttributeSourceIds  as well.


    <util:list id="shibboleth.c14n.attribute.AttributesToResolve">

        <value>proxied-uid</value>

    </util:list>



    <util:list id="shibboleth.c14n.attribute.AttributeSourceIds">

        <value>proxied-uid</value>

    </util:list>


  1.  Updated idp-metadata.xml to have it serve as an SP as well. Referring to what it noted under Preparation on this document: https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP#UsingSAMLProxyingtoanotherIdP-Preparation which was just adding the <SPSSODescriptor>  details with the certificates and AssertionConsumerService URL.



  1.  In general-authn.xml uncommented this:

        <bean id="authn/SAML" parent="shibboleth.AuthenticationFlow"

            p:nonBrowserSupported="false"

            p:passiveAuthenticationSupported="true"

            p:forcedAuthenticationSupported="true"

            p:proxyScopingEnforced="true"

            p:discoveryRequired="true" />


  1.  In idp.properties file updated the workflow to SAML

idp/authn/flows=SAML





Thanks,


Brent Goebel
Systems Engineer III
Information Technology ‖  University of Denver

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220222/c3911d19/attachment.htm>