<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>
<div>Dave & Scott,</div>
<div><br>
</div>
<div>Thanks for taking the time to respond. Scott, you're right, as Dave pointed out there are all sorts of things I could do in the SP to customize behavior on a per-IDP basis, but as you correctly inferred, I'm not doing anything anywhere near that fancy
in my SP. I think I changed three or four lines from the shibboleth2.xml file that got installed when I built the package. :-)</div>
<div><br>
</div>
<div>I'll follow up with the IDPs.</div>
<div><br>
</div>
<div>--Ken</div>
<div>
<div>
<div style="font-family: Consolas; font-size: medium; ">------------------------------------------------------------</div>
<div style="font-family: Consolas; font-size: medium; ">Ken Weiss <a href="mailto:ken.weiss@ucop.edu">ken.weiss@ucop.edu</a></div>
<div style="font-family: Consolas; font-size: medium; ">UC Office of the President 510-587-6311 (office)</div>
<div style="font-family: Consolas; font-size: medium; ">California Digital Library 916-905-6933 (mobile)</div>
<div style="font-family: Consolas; font-size: medium; ">UC Curation Center</div>
<div style="font-family: Consolas; font-size: medium; ">415 20th Street, 4th Floor</div>
<div style="font-family: Consolas; font-size: medium; ">Oakland, CA 94612</div>
</div>
<div><br>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Lucida Grande; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>David Langenberg <<a href="mailto:davel@uchicago.edu">davel@uchicago.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, February 6, 2014 2:31 PM<br>
<span style="font-weight:bold">To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Does Shibboleth SP have any per-IDP config?<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">The answers are yes and no. You could, with application overrides, make your SP behave differently for each IdP you integrate with. However, I'm betting the problems here are at the IdP end especially if you're integrating via InCommon. Unfortunately,
you're going to have to slog it out with the IdP admins in this case. Turning your logs up & capturing the decrypted assertions will assist with identifying where the problems lie and assist with tweaks you may want to make to your attribute-map to accommodate
the other IdP's "specialness". As for InCommon not releasing attributes, that's a new one. Perhaps the IdP admin is expecting your SP to be tagged by InC as an R&S SP which would trigger a filter policy automatically & that's what they mean?
<div><br>
</div>
<div>Dave</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Feb 6, 2014 at 3:14 PM, Ken Weiss <span dir="ltr">
<<a href="mailto:ken.weiss@ucop.edu" target="_blank">ken.weiss@ucop.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'm pretty sure the answer is 'no', but I wanted to ask the broader group<br>
just to be certain.<br>
<br>
If my Shibboleth SP works with 3 different IDPs, but doesn't work with 3<br>
others (failing in a different way for each of them), it's a pretty safe<br>
bet that the configuration issues are with the IDP, not my SP, right?<br>
<br>
I have one IDP that is returning two identical email addresses in the<br>
'mail' attribute. That's causing our application to error out, which we<br>
need to fix since email is a multi-valued attribute. But it's got nothing<br>
to do with my SP.<br>
<br>
I have one that isn't authorizing to my application correctly, which is<br>
almost certainly a result of the IDP not releasing the right attributes.<br>
<br>
And I have one that, for reasons that truly baffle me, reports that<br>
"InCommon is not releasing the proper attributes." I have no idea what<br>
InCommon would have to do with this - all they do is deliver the metadata<br>
for my SP. Other than that, InCommon is not involved in the interaction,<br>
since I'm no longer using InCommon's Discovery Service.<br>
<br>
Anyway, before I tell them all to look at their own IDP configuration, I<br>
thought it would be good to get a quick sanity check from some people that<br>
have actually run an IDP at some point in their life (unlike me...).<br>
Thanks!<br>
<br>
--Ken<br>
------------------------------------------------------------<br>
Ken Weiss <a href="mailto:ken.weiss@ucop.edu">ken.weiss@ucop.edu</a><br>
UC Office of the President <a href="tel:510-587-6311" value="+15105876311">510-587-6311</a> (office)<br>
California Digital Library <a href="tel:916-905-6933" value="+19169056933">916-905-6933</a> (mobile)<br>
UC Curation Center<br>
415 20th Street, 4th Floor<br>
Oakland, CA 94612<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
David Langenberg
<div>Identity & Access Management</div>
<div>The University of Chicago</div>
</div>
</div>
</div>
</span>
</body>
</html>