I got some guidance from a person with Blackboard. Certainly gave me the confidence that even in my Shib 2.4.x attempt I actually did have it setup correctly. <div><br></div><div>What I was doing wrong was passing in unscoped attributes ( not claim :D ) into the SAML token. I have mapped StudentID (batch uid/external uid in Blackboard) to AD acct attribute EmployeeID. I was publishing it to both the eduPersonPrincipalName attribute. I modified my custom ADFS rule (that swaps the attribute to eduPersonPrincipalName) to just append '@local' (Value = c.Value + '@local') on to my attribute (using for local SSO, no outside federated IDs). Another option would have been of course to switch to UPN or Email address as the mapped ID, but for name/account changes mid-term, this would cause more problems in the short term.<div>
<br></div><div>Thanks all!</div><div><br></div><div>-Richard<br><br><div class="gmail_quote">On Thu, Nov 17, 2011 at 3:07 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">On 11/17/11 2:17 PM, "Richard Wendel" <<a href="mailto:richard.e.wendel@gmail.com">richard.e.wendel@gmail.com</a>> wrote:<br>
><br>
>I wanted to find out if anyone was using the Blackboard Shibboleth<br>
>authentication module with current (2.4.x) software and what additional<br>
>steps were needed. I have already repackaged the RPM for Apache 1.3.41<br>
>that is included in Blackboard 9.1. I have it passing me to a "secure"<br>
>area after successfully authenticating against my ADFS, so it appears<br>
>that my Apache integration specifically of Shibboleth works fine.<br>
<br>
</div>Then apart from support issues, there's no concern.<br>
<div class="im"><br>
>My guess is that I believe previous versions used the Header vars to pass<br>
>info, and current uses the Env vars.<br>
<br>
</div>Both support both. Defaults are different.<br>
<div class="im"><br>
> In addition, they recommend a separate mapped var (ShibMapAttribute)<br>
>when using Ajp1.2 (which is what is there) since REMOTE_USER doesn't get<br>
>sent properly, which isn't an Apache directive in the current versions of<br>
>Shib.<br>
<br>
</div>I don't even remember what that command did to be honest, but there is no<br>
material difference here, and REMOTE_USER works fine with AJP.<br>
<div class="im"><br>
>Also, is there a way to log/capture the unencrypted claims after<br>
>attribute mapping in Shib so I can verify the claims mapping from ADFS to<br>
>what Shib expects like eppn, etc.<br>
<br>
</div>Attribute, not claim. When MS starts enhancing their offering, I'll<br>
consider using their invented terminology. ;-)<br>
<br>
If you can see the headers and/or environment, you see exactly what the<br>
app sees. If you're talking about dumping the SAML, that's available via<br>
logging. If you mean something else, let me know.<br>
<br>
Bottom line, the app integration available with SP 1.x is all supported in<br>
2.x, no exceptions.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div></div>