<div dir="ltr">Sorry for the previous incomplete message. I hit "send" by mistake.<br><div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 18, 2013 at 7:50 PM, Patrick Le <span dir="ltr"><<a href="mailto:ple@jhmi.edu" target="_blank">ple@jhmi.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="">Does anyone have any experience integrating SAML 2.0 authentication against Juniper Secure Access with Shibboleth as the IDP?<u></u><u></u></p></div></div></blockquote><div><br></div><div>Yes, we're doing this.<br>
</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div link="blue" vlink="purple" lang="EN-US"><div>
<p class="">I’m having issues getting the Juniper appliance to pick up the userID from the attribute assertion. On the juniper appliance under the “Auth Server” configuration page, there is a “User Name Template” field where you’re supposed to define
the attribute name for the userID. Examples given by juniper are:<u></u><u></u></p>
<p class=""><u></u> <u></u></p>
<p class=""><span>Example: <assertionNameDN.uid>, uid from X509SubjectName.
</span><br>
<span>The entire assertion name identifier if not specified; Or
</span><br>
<span><userAttr.attr>, attr from AttributeStatement attributes.<u></u><u></u></span></p>
<p class=""><span><u></u> <u></u></span></p>
<p class=""><span><u></u> <u></u></span></p>
<p class=""><span>I first tried to leave the field blank so that it gets the name identifier from the entire assertion. That allows me to login, but the UserID from the juniper logs is some random string of numbers which means
nothing to us because we can’t correlate that back to an actual user. I tried various other methods like:<u></u><u></u></span></p><span></span></div></div></blockquote><div><br></div><div>I tried all of this too. Never got attributes to work. The only way I got it to work was to use the Name Identifier. In that case, you'll want to leave the "User Name Template" field blank.<br>
<br></div><div>Do you have a "release transient ID to anybody" rule somewhere in your attribute-filter.xml? If so, you need to exclude the VPN, or it will populate NameID with the aforementioned random string of numbers. You'd want to modify your release rule to look something like this:<br>
<br> <AttributeFilterPolicy id="releaseTransientIdToAnyone"><br> <PolicyRequirementRule xsi:type="basic:NOT"><br> <basic:Rule xsi:type="basic:OR"><br> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://newvpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1">https://newvpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1</a>" /><br>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://vpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1">https://vpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1</a>" /><br>
</basic:Rule><br> </PolicyRequirementRule><br><br> <AttributeRule attributeID="transientId"><br> <PermitValueRule xsi:type="basic:ANY" /><br>
</AttributeRule><br><br> </AttributeFilterPolicy><br><br></div><div>Then, in attribute-resolver.xml, you need to set a definition up that encodes your user ID as a SAML2 Name Identifier:<br><br> <resolver:AttributeDefinition id="uidAsNameIdentifier"<br>
xsi:type="Simple"<br> xmlns="urn:mace:shibboleth:2.0:resolver:ad"><br> <resolver:Dependency ref="uid" /><br><br> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /><br> </resolver:AttributeDefinition><br><br></div><div>Then in attribute-filter.xml, just set up a release rule:<br></div>
<div> <br></div><div> <AttributeFilterPolicy id="VPN"><br> <PolicyRequirementRule xsi:type="basic:OR"><br> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://newvpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1">https://newvpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1</a>" /><br>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://vpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1">https://vpn.umbc.edu/dana-na/auth/saml-endpoint.cgi?p=sp1</a>" /><br>
</PolicyRequirementRule><br><br> <AttributeRule attributeID="uidAsNameIdentifier"><br> <PermitValueRule xsi:type="basic:ANY" /><br> </AttributeRule><br>
</AttributeFilterPolicy><br><br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div link="blue" vlink="purple" lang="EN-US"><br>
<div><span> </span>
<p class=""><span>Juniper support has been less than helpful, so I’m hoping I’ll get better luck on the shib users list.
<u></u><u></u></span></p>
<p class=""><span></span></p></div></div></blockquote><div>If you need any further help setting up the Juniper side of things, feel free to drop me an email. I have lots of notes.<br><br></div><div>Hope this helps,<br></div>
<div>Paul <br></div></div></div></div></div>