Issue setting up SSO with Graduway

[Alberto DeAngelis]

Hello,

I am having some issues setting up SSO for a vendor named Graduway.

On saml tracer it doesn't seem to be sending them the attributes that I set
up in attribute-filter.xml:

<AttributeFilterPolicy id="releaseForGraduway" >
  <PolicyRequirementRule xsi:type="RequesterRegex"
regex="https:\/\/.*\.*\.*\.*\.graduway.com\/.*" />
  <AttributeRule attributeID="eduPersonPrincipalName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="mail">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="givenName">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="surname">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
</AttributeFilterPolicy>

I have encrypt assertions turned off:
        <bean parent="RelyingPartyByName" c:relyingPartyIds="graduway">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

metadata-providers.xml:
 <MetadataProvider id="GRADUWAY"  xsi:type="FilesystemMetadataProvider"
metadataFile="%{idp.home}/metadata/graduway.xml"/>

graduway.xml:

<EntityDescriptor cacheDuration="PT1H" entityID="<entity_id_url>"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><SPSSODescriptor
AuthnRequestsSigned="false" WantAssertionsSigned="false"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="<entity_id_url>" isDefault="true" index="0"
/><AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="<entity_id_url>" isDefault="false" index="1"
/><AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="<entity_id_url>" isDefault="false" index="2"
/><AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="<entity_id_url>" isDefault="false" index="3"
/></SPSSODescriptor></EntityDescriptor>

This is the error I see in SAML tracer:

<saml2p:Status> <saml2p:StatusCode Value=
"urn:oasis:names:tc:SAML:2.0:status:Responder" /> <saml2p:StatusMessage>An
error occurred.</saml2p:StatusMessage> </saml2p:Status>

Auth logs:

shib-idp;idp-process.log;dev;nothing; - [10.0.0.0]2024-07-23 20:02:22,802 -
INFO [Shibboleth-Audit.SSO:338] -
2024-07-23T20:02:22.802073Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|idaa21fd7db0d14dfa9555524d77cad219|
https://api.prod.us-east1.manual.graduway.com/Saml2|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://
<some_url>/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_05e22dd43dc51fb8e7ba2ff55715e605||||||

Any help would be greatly appreciated.

Thank you,
Alberto

-- 
Alberto DeAngelis '20 '22
*Database Administrator*
*Information Technology Services*
[image: Manhattan College Logo/Shield]
Riverdale, NY 10471
adeangelis01 at manhattan.edu
www.manhattan.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240723/95168abb/attachment.htm>