<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
> Out of the box Panopto supports ADFS, which is SAML 2,><BR> <BR>The statment that ADFS is SAML 2 is not really relevant in this case.<BR> <BR>The metadata they publish reveals they are using WS-* protocols and not SAML. Their application is probably using WIF which means they don't really even need ADFS on their side.<BR> <BR><a href="https://panoptoacs.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml">https://panoptoacs.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml</a> <a href="https://panoptoacs.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml"></a><BR> <BR>You can use an ADFSv2 server on your side to perform what amounts to a protocol translation from the SAMLv2 performed by your Shibboleth IdP to WS-Federation that the service provider expects. Your users would not have to see any of this if you control the URLs they'd use to reach the service provider.<BR><br>Randy <BR>Oxford Computer Group<br> <BR><div><div id="SkyDrivePlaceholder"></div>> From: chuck.kimber@usu.edu<br>> Date: Tue, 20 Mar 2012 15:04:06 -0600<br>> Subject: Shibb + Panopto + AD TokenGroups<br>> To: users@shibboleth.net<br>> <br>> We're working on implementing Panopto to record courses and hoping we<br>> can pull off authentication with Shibboleth. Out of the box Panopto<br>> supports ADFS, which is SAML 2, of course. Panopto doesn't officially<br>> support anything except ADFS, but we'd like to avoid confusing users<br>> by shipping them to yet another SSO.<br>> <br>> So my first question would be, has anyone out there successfully used<br>> Shibboleth to authenticate Panopto? The google searches and reading<br>> I've done seem thin... If someone has pulled it off, they don't seem<br>> to be talking about it. I would welcome any tips, examples, insight<br>> and warnings you might have.<br>> <br>> I have been experimenting and playing with it, based on their ADFS<br>> config (http://support.panopto.com/focus-4-articles/24-activedirectory/399-hosted-panopto-federated-authentication)<br>> and have stored their metadata, configured basic filters etc, but<br>> there is one AD attribute they want that seems problematic. The AD<br>> attribute "tokenGroups". I am unable to pull this attribute<br>> successfully with any tool, even powershell with the ActiveDirectory<br>> module, to examine it.<br>> http://msdn.microsoft.com/en-us/library/windows/desktop/ms680275%28v=vs.85%29.aspx<br>> From what I've uncovered so far this attribute seems to be some kind<br>> of conglomerate value that has to then be broken down into SID's and<br>> enumerated. Even if I can get my hands on that attribute, I'm not<br>> sure how I would pull off the enumeration of it in Shibboleth. I'm<br>> hoping someone out there has cracked this nut before and can show me<br>> how. Any ideas?<br>> <br>> Chuck<br>> Utah State University<br>> --<br>> To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div> </div></body>
</html>