Thanks for the info Chad.<div>I saw in an earlier post that Scott was going to post an example... do you know if this ever happened as it would be very useful right about now!</div><div>Thanks again,</div><div>Regards, Pete<br>
<br><div class="gmail_quote">On 22 June 2012 12:20, Chad La Joie <span dir="ltr"><<a href="mailto:lajoie@itumi.biz" target="_blank">lajoie@itumi.biz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
You would use a special Session Initiator for that:<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator#NativeSPSessionInitiator-SAML2SessionInitiator%28ProtocolHandler%29" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator#NativeSPSessionInitiator-SAML2SessionInitiator%28ProtocolHandler%29</a><br>
<br>
That allows you to set the request NameID format via an attribute on the<br>
<SessionInitiator>. Note, if they require more customization of the<br>
<AuthnRequest> that <SessionInitiator> will take a template<br>
<AuthnRequest> as a child and then you can add whatever random stuff<br>
they want to it.<br>
<div class="im"><br>
On 6/22/12 7:13 AM, Pete Newing wrote:<br>
> All,<br>
> I've installed a new 2.4.3 SP and, following the wiki instructions,<br>
> successfully tested it against TestShib Two.<br>
> I've now changed this to point to a clients commercial IdP and found an<br>
> issue with authentication.<br>
> The client is telling me that I need to provide a specific name ID<br>
> format in my SAML auth request.<br>
> I've had a look in the archives and the wiki and it looks like I need an<br>
> AuthnRequest.<br>
> But I can't see where I would put this in my shibboleth2.xml file?<br>
> Could someone point me in the right direction please... Thanks in advance...<br>
><br>
> Here's a sanitized copy of the file....<br>
> <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br>
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br>
> clockSkew="1800"><br>
><br>
> <!-- Windows RequestMapper --><br>
> <!-- The RequestMap defines portions of the webspace to protect;<br>
</div>> <a href="http://mysp.example.com/" target="_blank">mysp.example.com/</a> <<a href="http://mysp.example.com/" target="_blank">http://mysp.example.com/</a>> here. --><br>
<div class="im">> <!--<br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap</a> --><br>
> <RequestMapper type="Native"><br>
> <RequestMap applicationId="default"><br>
</div>> <Host name="<a href="http://mysp.example.com" target="_blank">mysp.example.com</a> <<a href="http://mysp.example.com" target="_blank">http://mysp.example.com</a>>"><br>
<div><div class="h5">> <Path name="/" authType="shibboleth" requireSession="true"/><br>
> </Host><br>
> </RequestMap><br>
> </RequestMapper><br>
><br>
> <!-- The entityID is the name made for this SP. --><br>
> <ApplicationDefaults entityID="<a href="https://mysp.example.com/shibboleth-sp" target="_blank">https://mysp.example.com/shibboleth-sp</a>"<br>
> REMOTE_USER="eppn persistent-id targeted-id"><br>
><br>
> <!-- You should use secure cookies if at all possible. See<br>
> cookieProps in this Wiki article. --><br>
> <!--<br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions</a> --><br>
> <Sessions lifetime="28800" timeout="3600" checkAddress="false"<br>
> relayState="ss:mem" handlerSSL="false"><br>
><br>
> <!-- Triggers a login request directly to the myTargetIdP<br>
> IdP. --><br>
> <!--<br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO</a> --><br>
> <SSO entityID="<a href="https://myTargetIdP.com/saml20" target="_blank">https://myTargetIdP.com/saml20</a>"><br>
> SAML2 SAML1<br>
> </SSO><br>
><br>
> <!-- SAML and local-only logout. --><br>
> <!--<br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout</a><br>
> --><br>
> <Logout>SAML2 Local</Logout><br>
><br>
> <!--<br>
> Handlers allow you to interact with the SP and gather<br>
> more information. Try them out!<br>
> Attribute values received by the SP through SAML will be<br>
> visible at:<br>
> <a href="http://mysp.example.com/Shibboleth.sso/Session" target="_blank">http://mysp.example.com/Shibboleth.sso/Session</a><br>
> --><br>
><br>
> <!-- Extension service that generates "approximate" metadata<br>
> based on SP configuration. --><br>
> <Handler type="MetadataGenerator" Location="/Metadata"<br>
> signing="false"/><br>
><br>
> <!-- Status reporting service. --><br>
> <Handler type="Status" Location="/Status" acl="127.0.0.1"/><br>
><br>
> <!-- Session diagnostic service. --><br>
> <Handler type="Session" Location="/Session"<br>
> showAttributeValues="true"/><br>
><br>
> <!-- JSON feed of discovery information. --><br>
> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br>
><br>
> </Sessions><br>
><br>
> <!-- Error pages to display to yourself if something goes<br>
> horribly wrong. --><br>
> <Errors supportContact="<a href="mailto:me@my-email.com">me@my-email.com</a><br>
</div></div>> <mailto:<a href="mailto:me@my-email.com">me@my-email.com</a>>" logoLocation="logo.jpg"<br>
<div><div class="h5">> styleSheet="main.css"/><br>
><br>
> <!-- Loads and trusts a metadata file that describes MyTargetIdP<br>
> IdP and how to communicate with it. --><br>
> <MetadataProvider type="XML" file="/etc/shibboleth/myTagetIdP.xml"/><br>
><br>
> <!-- Attribute and trust options you shouldn't need to change. --><br>
> <AttributeExtractor type="XML" validate="true"<br>
> path="attribute-map.xml"/><br>
> <AttributeResolver type="Query" subjectMatch="true"/><br>
> <AttributeFilter type="XML" validate="true"<br>
> path="attribute-policy.xml"/><br>
><br>
> <!-- Your SP generated these credentials. They're used to talk<br>
> to IdP's. --><br>
> <CredentialResolver type="File" key="sp-key.pem"<br>
> certificate="sp-cert.pem"/><br>
><br>
> </ApplicationDefaults><br>
><br>
> <!-- Security policies you shouldn't change unless you know what<br>
> you're doing. --><br>
> <SecurityPolicyProvider type="XML" validate="true"<br>
> path="security-policy.xml"/><br>
><br>
> <!-- Low-level configuration about protocols and bindings available<br>
> for use. --><br>
> <ProtocolProvider type="XML" validate="true" reloadChanges="false"<br>
> path="protocols.xml"/><br>
><br>
> </SPConfig><br>
><br>
> Regards, Pete<br>
><br>
</div></div>> *Peter L.K. Newing, CISSP, CISA, ITIL V3 Foundation, ISO 27001 Lead Auditor*<br>
><br>
> *Director of **Product Management*<br>
><br>
> * *<br>
><br>
> UK Mobile: <a href="tel:%2B44%207545%20073%20406" value="+447545073406">+44 7545 073 406</a> <tel:%2B44%207545%20073%20406><br>
> US Mobile: <a href="tel:%2B1%20424%20789%200265" value="+14247890265">+1 424 789 0265</a> <tel:%2B1%20424%20789%200265><br>
<div class="HOEnZb"><div class="h5">><br>
><br>
><br>
> Flexeye Technology Ltd<br>
><br>
><br>
><br>
> This email and any attachments are confidential and may be privileged.<br>
> If you have received it in error, do not read it, copy it, forward it,<br>
> disclose its contents or use it for any purpose. Please notify us<br>
> immediately and then delete it. Any views or opinions expressed are<br>
> solely those of the author and not necessarily those of Flexeye<br>
> Technology Ltd. This email was sent from Flexeye Technology Limited,<br>
> Hays House, Millmead, Guildford GU2 4HJ. Registered Office: Wey Court<br>
> West, Union Road, Farnham, Surrey GU9 7PT United Kingdom. Registered in<br>
> England No 4852559. VAT no GB 821 3432 66A<br>
><br>
><br>
><br>
><br>
</div></div><span class="HOEnZb"><font color="#888888">> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
<br>
--<br>
Chad La Joie<br>
<a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a><br>
trusted identities, delivered<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><span style="font-family:arial,sans-serif;font-size:13px;border-collapse:collapse">
<p style="margin:0px"><b>Peter L.K. Newing, CISSP, CISA, ITIL V3 Foundation, ISO 27001 Lead Auditor</b></p>
<p style="margin:0px"><b><span lang="EN-GB">Director of </span></b><b><span lang="EN-GB">Product Management</span></b></p>
<p style="margin:0px"><b><span lang="EN-GB"> </span></b></p>
<div style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB">UK Mobile: +44 7545 073 406</span></div><div style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB">US Mobile: +1 424 789 0265</span></div>
<p style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB"> </span></p>
<p style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB">Flexeye Technology Ltd</span></p>
<p style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB"> </span></p>
<p style="margin:0px"><span style="font-family:Consolas;font-size:8pt">This email and any attachments are confidential and may be privileged. If you have received it in error, do not read it, copy it, forward it, disclose its contents or use it for any purpose. Please notify us immediately and then delete it. Any views or opinions expressed are solely those of the author and not necessarily those of Flexeye Technology Ltd. This email was sent from Flexeye Technology Limited, Hays House, Millmead, Guildford GU2 4HJ. Registered Office: Wey Court West, Union Road, Farnham, Surrey GU9 7PT United Kingdom. Registered in England No 4852559. VAT no GB 821 3432 66A</span></p>
</span><br>
</div>