<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Temporarily the college of business is assigning id directly for salesforce to a very few workers. This is not our preference.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If others are having issues with salesforce there is strength in numbers.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Have have worked with many vendors with our IdP. Salesforce is first to refuse. However, I have not yet personally worked with the vendor to make it clear
that we are not likely to change the encryption requirement between our IdP and the SP at salesforce.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">We have 550 SP doing it one who is not wanting to.. We will most likely hold the line on our requirement<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Warren
<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Eric Goodman<br>
<b>Sent:</b> Monday, June 11, 2012 2:37 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Salesforce with Shibboleth IdP<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">We're using HTTP-Post, so the latter. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Though I'd characterize it more that we "accept the risk of..." than that we "not worry about the lack of..." :) <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--- Eric<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Jun 11, 2012 at 11:19 AM, Chad La Joie <<a href="mailto:lajoie@itumi.biz" target="_blank">lajoie@itumi.biz</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">Eric, did you move to an attribute query model as well or did you just<br>
not worry about the lack of end-to-end confidentiality?<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
On Mon, Jun 11, 2012 at 2:16 PM, Eric Goodman <<a href="mailto:ericg@ucsc.edu">ericg@ucsc.edu</a>> wrote:<br>
> This is not really answering your direct question, but tangentially we had<br>
> this issue with a different vendor.<br>
><br>
> Our solution was to verify that the vendor's SAML client still verified the<br>
> message signature. Knowing the signature was checked, that ssl was being<br>
> used on all of the SAML transactions, and that the data being sent was<br>
> relatively benign (ePPN in this case) we got the okay to integrate without<br>
> encrypted assertions.<br>
><br>
> --- Eric<br>
><br>
><br>
> On Mon, Jun 11, 2012 at 10:33 AM, Keith Hazelton <<a href="mailto:hazelton@doit.wisc.edu">hazelton@doit.wisc.edu</a>><br>
> wrote:<br>
>><br>
>> -----BEGIN PGP SIGNED MESSAGE-----<br>
>> Hash: SHA1<br>
>><br>
>> Warren,<br>
>><br>
>> So that would leads me to ask Michael Chale--are you dropping Salesforce?<br>
>> If not, how are you addressing the conflict about encrypted vs.<br>
>> unencrypted?<br>
>><br>
>> --Keith<br>
>> ________________<br>
>> On Jun 11, 2012, at 13:23:55, Curry, Warren wrote:<br>
>><br>
>> > Andrew,<br>
>> ><br>
>> > I guess this response from Mike Chale at UF - College of Business was<br>
>> > bounced back to him I am forwarding on to the list.. We had issue due to<br>
>> > required encryption at UF.<br>
>> > Warren<br>
>> > ==================================.<br>
>> ><br>
>> > Good afternoon, Andrew<br>
>> ><br>
>> ><br>
>> > We tried to use Shibboleth as an IdP but ran into a few stumbling<br>
>> > blocks, one of which was a show-stopper - Salesforce cannot handle encrypted<br>
>> > responses from the IdP and our university's current policy is to only<br>
>> > provide encrypted responses.<br>
>> ><br>
>> > If you would like to discuss any further details I would be happy to<br>
>> > help you out.<br>
>> ><br>
>> ><br>
>> > Michael Chale<br>
>> > Solutions Engineer<br>
>> > Technology Solutions<br>
>> ><br>
>> > -----Original Message-----<br>
>> > From: <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>]<br>
>> > On Behalf Of Andrew Morgan<br>
>> > Sent: Monday, June 11, 2012 12:52 PM<br>
>> > To: Shib Users<br>
>> > Subject: Re: Salesforce with Shibboleth IdP<br>
>> ><br>
>> > On Fri, 8 Jun 2012, Peter Schober wrote:<br>
>> ><br>
>> >> * Andrew Morgan <<a href="mailto:morgan@orst.edu">morgan@orst.edu</a>> [2012-06-07 18:42]:<br>
>> >>> Login Error<br>
>> >>> Your login attempt using single sign-on with an identity provider<br>
>> >>> certificate has failed. Please contact your <a href="http://salesforce.com" target="_blank">
salesforce.com</a><br>
>> >>> administrator<br>
>> >>> for more information.<br>
>> >><br>
>> >> If all else fails you could try just that?<br>
>> >> -peter<br>
>> ><br>
>> > Unfortunately, my co-worker is the administrator and we are both trying<br>
>> > to understand what is going wrong! :)<br>
>> ><br>
>> > We have tried using Salesforce's SAML assertion validator, but that<br>
>> > doesn't raise any errors. I was hoping someone might have experience with<br>
>> > Salesforce, or at least have a working Shibboleth-Salesforce setup that I<br>
>> > could compare against.<br>
>> ><br>
>> > Thanks,<br>
>> > Andy<br>
>> > --<br>
>> > To unsubscribe from this list send an email to<br>
>> > <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>> > --<br>
>> > To unsubscribe from this list send an email to<br>
>> > <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>><br>
>> -----BEGIN PGP SIGNATURE-----<br>
>> Version: GnuPG/MacGPG2 v2.0.18 (Darwin)<br>
>> Comment: GPGTools - <a href="http://gpgtools.org" target="_blank">http://gpgtools.org</a><br>
>><br>
>> iQEcBAEBAgAGBQJP1ivXAAoJEPXbVHOlscTvm3MIAMCMEtbX82PVB2XKce1qK3j8<br>
>> zRK3q9Hz/9BfFWDScq5sMPFrmMicmhZiq59D+RCAshDOYmT/QpZ+81ciggCRLrlO<br>
>> cN8UfpUhQ5cZ4YYAXCrlsI+GY7k3zksIJpPIwDGBnA6mhlHfd0ed91HeY/mIUNnE<br>
>> C6zrP9lXiRDrWRWuwXJyYV8lEAUc3YHDzOColZQwZp7PIHZkLeij90lXDC5axrNr<br>
>> +LeFPD/YQd3WNJ3dJ9RjDJTuS6wnRfQT3UpwGxuXM+bKNBuS2AS3uHfU9zTehQd4<br>
>> 6vXEbkVLhivFjxZPwO2+3qSXBHq7xhi0PrNu1mWixesUPXNyMOQoSvuO7jRNqGc=<br>
>> =3tCg<br>
>> -----END PGP SIGNATURE-----<br>
>> --<br>
>> To unsubscribe from this list send an email to<br>
>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
><br>
> --<br>
> To unsubscribe from this list send an email to<br>
> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
<br>
--<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span class="hoenzb"><span style="color:#888888">Chad La Joie</span></span><span style="color:#888888"><br>
<span class="hoenzb"><a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a></span><br>
<span class="hoenzb">trusted identities, delivered</span></span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>