<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://308/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Box's capability for handling groups may improve soon. I strongly encourage you to give them timely, detailed, precise feedback on exactly how you would like to integrate your groups with their product.
<div><br>
<div>
<div>On Apr 2, 2014, at 7:41 AM, "Bryan E. Wooten" <<a href="mailto:bryan.wooten@utah.edu">bryan.wooten@utah.edu</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); ">Strange, I was just on a call with Box for our Shib integration 2 weeks ago.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); ">No mention of AD group membership. As a matter of fact they did not want us to release group memberships in the SAML assertion. They also recommended we not use their API for groups either. They said most U’s don’t use
the API.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); ">In your integration do they want direct access to your Active Directory? That sounds like a bad idea.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); ">-Bryan<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); "> </span></div>
<div>
<div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0in 0in; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>
[mailto:users-<a href="mailto:bounces@shibboleth.net">bounces@shibboleth.net</a>]<b>On Behalf Of<span class="Apple-converted-space"> </span></b>Vignesh, Vanna G.<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, April 02, 2014 7:27 AM<br>
<b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Using two dataconnectors for one service provider<o:p></o:p></span></div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Our Idp uses authldap as the only data connector. One of the SPs (<a href="http://box.com">box.com</a> provisioning) requires the user should be in AD security group too. All the mandatory attributes will be from authldap.<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
The user should not get successful authentication if he is not in that AD group. How can I handle this?<o:p></o:p></div>
</div>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div>
</body>
</html>