<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.csssmallgray
{mso-style-name:csssmallgray;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1381897421;
mso-list-type:hybrid;
mso-list-template-ids:1213099248 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Does anyone have any experience integrating SAML 2.0 authentication against Juniper Secure Access with Shibboleth as the IDP?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m having issues getting the Juniper appliance to pick up the userID from the attribute assertion. On the juniper appliance under the “Auth Server” configuration page, there is a “User Name Template” field where you’re supposed to define
the attribute name for the userID. Examples given by juniper are:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span class="csssmallgray">Example: <assertionNameDN.uid>, uid from X509SubjectName.
</span><br>
<span class="csssmallgray">The entire assertion name identifier if not specified; Or
</span><br>
<span class="csssmallgray"><userAttr.attr>, attr from AttributeStatement attributes.<o:p></o:p></span></p>
<p class="MsoNormal"><span class="csssmallgray"><o:p> </o:p></span></p>
<p class="MsoNormal"><span class="csssmallgray"><o:p> </o:p></span></p>
<p class="MsoNormal"><span class="csssmallgray">I first tried to leave the field blank so that it gets the name identifier from the entire assertion. That allows me to login, but the UserID from the juniper logs is some random string of numbers which means
nothing to us because we can’t correlate that back to an actual user. I tried various other methods like:<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span class="csssmallgray"><span style="mso-list:Ignore">1)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span class="csssmallgray"><userAttr.urn:oid:XXX.XXX.XXXX> (where XXX is the object identifier for our userID attribute)<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span class="csssmallgray"><span style="mso-list:Ignore">2)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span class="csssmallgray">urn:oid:XXX.XXX.XXXX<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span class="csssmallgray"><span style="mso-list:Ignore">3)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span class="csssmallgray"><userAttr.EPPN><o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span class="csssmallgray"><span style="mso-list:Ignore">4)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span class="csssmallgray"><UserAttr.uid><o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span class="csssmallgray"><span style="mso-list:Ignore">5)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span class="csssmallgray">uid<o:p></o:p></span></p>
<p class="MsoNormal"><span class="csssmallgray"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span class="csssmallgray"><span style="mso-list:Ignore">6)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span class="csssmallgray">When I use the examples that begin with “<” and end in “>”, I get “Invalid Assertion Error” on the juniper side after authenticating. If I leave out the brackets, the value that gets returned as the
UserID is literally what is typed in the Name Template Field. So in example 2, the signed in user was “urn:oid:XXX.XXX.XXXX” and example 5 returned “uid”<o:p></o:p></span></p>
<p class="MsoListParagraph"><span class="csssmallgray"><o:p> </o:p></span></p>
<p class="MsoNormal"><span class="csssmallgray">Juniper support has been less than helpful, so I’m hoping I’ll get better luck on the shib users list.
<o:p></o:p></span></p>
<p class="MsoNormal"><span class="csssmallgray"><o:p> </o:p></span></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Patrick<o:p></o:p></p>
</div>
</body>
</html>