<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>We've done several things in our IdP lately that have broken our Google Apps login. Today, I sat down to figure out what's going on.</div>
<div><br>
</div>
<div>Here's an example. If I edit attribute-resolver.xml to resolve organizationalUnit, attempts to login to gmail are met with "Invalid Email"</div>
<div><br>
</div>
<div>In the idp-process.log, I see the following</div>
<div><br>
</div>
<div><br>
</div>
<div>Without organizationalUnit resolution (google works):</div>
<div><br>
</div>
<div><font class="Apple-style-span" face="'Andale Mono'">17:26:17.668 - INFO [Shibboleth-Audit:970] - 20121016T222617Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|aoobokmhbpbgeecocphmjjbomdneeggcpddihjlp|google.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.uark.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_aaab02e2b9f6b4d5e2893976e1bb8bde|donf|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||donf|_ab0b97b7903624fc7131c6a059bc3c84,|</font></div>
<div><br>
</div>
<div><br>
</div>
<div>With organizationalUnit resolution (google fails):</div>
<div><br>
</div>
<div>
<div><font class="Apple-style-span" face="'Andale Mono'">17:21:19.915 - INFO [Shibboleth-Audit:970] - 20121016T222119Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|hfbphmjbhhpnilmgbdopmnklimcbpipjikjhlfcj|google.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.uark.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_27104b306c0c2b4e0d77cb56dd4a508e|donf|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_e1efc96c3a39693be819220f16e117d7|_a67c6dd0dcbf17a475c74914c42acc01,|</font></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>What was "donf" in the first log line is "_e1efc96c3a39693be819220f16e117d7" in the second. I think this is the problem. What I don't understand is what's causing it. </div>
<div><br>
</div>
<div>Also, a possibly-related question. Is there a "better" way to handle Google Apps instead of using a specific RelyingParty?</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>=== Relavent Configuration ==</div>
<div><br>
</div>
<div><br>
</div>
<div>My google metadata looks like:</div>
<div><br>
</div>
<div>
<div><font class="Apple-style-span" face="'Andale Mono'"><EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="<a href="http://google.com">google.com</a>"></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <AssertionConsumerService index="1"</font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> Location="<a href="https://www.google.com/a/gm.uark.edu/acs">https://www.google.com/a/gm.uark.edu/acs</a>"/></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> </SPSSODescriptor></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"></EntityDescriptor></font></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>My relying-party.xml has the following:</div>
<div><br>
</div>
<div>
<div><font class="Apple-style-span" face="'Andale Mono'"><rp:RelyingParty id="<a href="http://google.com">google.com</a>"</font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> provider="<a href="https://idp.uark.edu/idp/shibboleth">https://idp.uark.edu/idp/shibboleth</a>"</font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> defaultSigningCredentialRef="IdPCredential"></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <rp:ProfileConfiguration </font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> xsi:type="saml:SAML2SSOProfile" </font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> encryptAssertions="never" encryptNameIds="never" /></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"></rp:RelyingParty></font></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>My attribute-resolver has the following:</div>
<div><br>
</div>
<div>
<div><font class="Apple-style-span" face="'Andale Mono'"><resolver:AttributeDefinition </font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> id="principal" xsi:type="PrincipalName" </font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> xmlns="urn:mace:shibboleth:2.0:resolver:ad"></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" </font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"></resolver:AttributeDefinition></font></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>(and for organizationalUnit:</div>
<div><br>
</div>
<div>
<div><font class="Apple-style-span" face="'Andale Mono'"><resolver:AttributeDefinition xsi:type="ad:Simple" </font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> id="organizationalUnit" sourceAttributeID="ou"></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <resolver:Dependency ref="uarkLDAP" /></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <resolver:AttributeEncoder </font><span class="Apple-style-span" style="font-family: 'Andale Mono'; ">xsi:type="enc:SAML1String" </span></div>
<div><span class="Apple-style-span" style="font-family: 'Andale Mono'; "> name="urn:mace:dir:attribute-def:ou" /></span></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" </font></div>
<div><span class="Apple-style-span" style="font-family: 'Andale Mono'; "> </span><span class="Apple-style-span" style="font-family: 'Andale Mono'; "> </span><font class="Apple-style-span" face="'Andale Mono'">name="urn:oid:2.5.4.11" friendlyName="ou"
/></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"></resolver:AttributeDefinition></font></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>My attribute-filter.xml has the following:</div>
<div><br>
</div>
<div>
<div><font class="Apple-style-span" face="'Andale Mono'"><afp:AttributeFilterPolicy id="GoogleApps"></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <afp:PolicyRequirementRule </font></div>
<div><span class="Apple-style-span" style="font-family: 'Andale Mono'; "> </span><span class="Apple-style-span" style="font-family: 'Andale Mono'; "> </span><font class="Apple-style-span" face="'Andale Mono'">xsi:type="basic:AttributeRequesterString" </font></div>
<div><span class="Apple-style-span" style="font-family: 'Andale Mono'; "> </span><span class="Apple-style-span" style="font-family: 'Andale Mono'; "> </span><font class="Apple-style-span" face="'Andale Mono'">value="<a href="http://google.com">google.com</a>"
/></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <afp:AttributeRule attributeID="principal"></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> <afp:PermitValueRule xsi:type="basic:ANY" /></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"> </afp:AttributeRule></font></div>
<div><font class="Apple-style-span" face="'Andale Mono'"></afp:AttributeFilterPolicy></font></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<br>
<div>
<div id="signature-separator" style="line-height:5px; color: #888;">-- </div>
<div id="sig" style="margin: 6px 0; padding: 8px; border-top: 1px #000 dotted; font: 11px/13px 'Century Gothic', Arial, Sans-Serif; color:#be0f34;">
<img src="http://goo.gl/2ZYiQ" alt="me" width="37" height="37" border="0" moz-do-not-send="true" style="float:left; padding: 2px 6px 0 0;">
<div id="line1" style="font-family: 'Sorts Mill Goudy'; font-style: normal; font-weight: 400; src: local('Sorts Mill Goudy Regular'), local('SortsMillGoudy-Regular'), url('http://themes.googleusercontent.com/static/fonts/sortsmillgoudy/v2/JzRrPKdwEnE8F1TDmDLMUhxcROG_7vu2ubkyRjqgeRY.ttf') format('truetype');">
<span style="color: black; font-weight:bold;">Don Faulkner, CISSP</span> | <span>
<a onmouseover="this.style.borderBottom = '1px solid #be0f34'" onmouseout="this.style.borderBottom = '1px dotted #be0f34'" style="color:#be0f34; text-decoration: none; border-bottom: 1px #be0f34 dotted;" href="http://its.uark.edu/">IT Security</a> at the
<a onmouseover="this.style.borderBottom = '1px solid #be0f34'" onmouseout="this.style.borderBottom = '1px dotted #be0f34'" style="color:#be0f34; text-decoration: none; border-bottom: 1px #be0f34 dotted; font-variant:small-caps;" href="http://www.uark.edu/">
University of Arkansas</a></span></div>
<div id="line2"><span style="font-family: Monaco, 'Lucida Sans Typewriter', monospace; font-family: 'Ubuntu Mono'; font-style: normal; font-weight: normal; src: local('Ubuntu Mono'), local('UbuntuMono-Regular'), url('http://themes.googleusercontent.com/static/fonts/ubuntumono/v2/ViZhet7Ak-LRXZMXzuAfkZ0EAVxt0G0biEntp43Qt6E.ttf') format('truetype'); color: black;">contact>>
</span><span style=""><a onmouseover="this.style.borderBottom = '1px solid #be0f34'" onmouseout="this.style.borderBottom = '1px dotted #be0f34'" style="color:#be0f34; text-decoration: none; border-bottom: 1px #be0f34 dotted;" href="mailto:donf@uark.edu">donf@uark.edu</a>
| +1 (479) 575-2905</span></div>
<div id="line3"><span style="font-family: Monaco, 'Lucida Sans Typewriter', monospace; font-family: 'Ubuntu Mono'; font-style: normal; font-weight: normal; src: local('Ubuntu Mono'), local('UbuntuMono-Regular'), url('http://themes.googleusercontent.com/static/fonts/ubuntumono/v2/ViZhet7Ak-LRXZMXzuAfkZ0EAVxt0G0biEntp43Qt6E.ttf') format('truetype'); color: black;">connect>>
</span><span style=""><a onmouseover="this.style.borderBottom = '1px solid #be0f34'" onmouseout="this.style.borderBottom = '1px dotted #be0f34'" style="color:#be0f34; text-decoration: none; border-bottom: 1px #be0f34 dotted;" href="http://www.facebook.com/uarkITS">uarkITS
on Facebook</a> | <a onmouseover="this.style.borderBottom = '1px solid #be0f34'" onmouseout="this.style.borderBottom = '1px dotted #be0f34'" style="color:#be0f34; text-decoration: none; border-bottom: 1px #be0f34 dotted;" href="http://twitter.com/uaits">
@uaits</a> | <a onmouseover="this.style.borderBottom = '1px solid #be0f34'" onmouseout="this.style.borderBottom = '1px dotted #be0f34'" style="color:#be0f34; text-decoration: none; border-bottom: 1px #be0f34 dotted;" href="http://twitter.com/dfaulkner">
@dfaulkner</a> </span></div>
</div>
</div>
<br>
</body>
</html>