<div dir="ltr">Thanks Peter for the Detailed response, will report back if we managed to pull this off for future reference ...</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Jun 7, 2014 at 5:29 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Kobi Seviliya <<a href="mailto:kobi@outbrain.com">kobi@outbrain.com</a>> [2014-06-06 21:18]:<br>
<div class="">> We are looking at integrating Shibboleth with TribeHR which supports other<br>
> SAML solutions like OKTA but doesn't officially support shibboleth .<br>
> Therefore they do not give out any metadata file to use with our IDP .<br>
<br>
</div>That ("Therefore") is a non sequitur: You don't need to officially<br>
support "Shibboleth" and can still create SAML 2.0 Metadata describing<br>
the essential operational details of your SAML deployment to others in<br>
a standardized (and machine-readable) way.<br>
<div class=""><br>
> 2. can i create a metadata file for them myself ? any guidance on<br>
> that will be much appreciated ...<br>
<br>
</div>FWIW, based on a quick web search and<br>
<a href="http://irclog.perlgeek.de/openam/2014-04-30/text" target="_blank">http://irclog.perlgeek.de/openam/2014-04-30/text</a><br>
a minimal hypothetical Entity Descriptor for their service could look<br>
like this:<br>
<br>
<EntityDescriptor entityID="TribeHR" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br>
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat><br>
<AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://zw.mytribehr.com/saml/response" target="_blank">https://zw.mytribehr.com/saml/response</a>" index="1"/><br>
</SPSSODescriptor><br>
</EntityDescriptor><br>
<br>
That assumes the ACS Location URL is the same for all customers<br>
(highly unlikely from experiences with commercial SaaS offerings<br>
relayed here), but you can always look at the authnRequest they send<br>
for you.<br>
<br>
Unless you have alraedy done so (e.g for other vendors) you'll have to<br>
create a custom relying party in Shib IDP to disable encryption of<br>
assertions to that RP (otherwise the IPD will b0rk on the missing<br>
certificate), unless you find indication they support that (and the<br>
matching public key).<br>
<br>
Assuming they actually cared about the NameID in the assertion's<br>
Subject, you'd need to create an attribute defintion depending<br>
(sourceAttributeID) on your existing email attribute definition, with<br>
I think an attribute encoder of type SAML2StringNameID and<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",<br>
going from memory. And appropriate filter rules to get that released<br>
(instead of persistentId or transientId).<br>
<br>
> Their SAML setup only asks for two fields.. Identity Provider Login<br>
> URL and Identity Provider Certificate<br>
<br>
The former is probably your IDP's SingleSignOnService Location<br>
(assuming HTTP-Redirect, otherwise try HTTP-POST)<br>
<a href="https://your.idp.example.org/idp/profile/SAML2/Redirect/SSO" target="_blank">https://your.idp.example.org/idp/profile/SAML2/Redirect/SSO</a><br>
and the latter your IDP's pubic key, allowing them to verify signed<br>
assertions (or responses), seemingly.<br>
HTH,<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div style="width:620px;color:#404040">
<div style="background-color:#dbdbdb;padding:8px 8px 15px 8px;border-radius:0 0 5px 5px">
<span style="font-size:12px"><strong>Kobi Seviliya,</strong> <span style="margin-left:5px">IT Manager</span><br>
</span></div><div style="background-color:#dbdbdb;padding:8px 8px 15px 8px;border-radius:0 0 5px 5px"><span style="font-size:12px"><span style="margin-left:5px"><img src="http://widgets.outbrain.com/external/company/ob-full-logo.png"><br>
</span></span></div>
<div style="margin-top:10px">
<span style="font-size:12px"><span style="float:left;margin-right:25px;margin-bottom:10px"><strong>T: </strong>073-2238947</span> <span style="float:left;margin-right:25px"><strong>M: </strong>052-6500978</span> <span style="float:left;margin-right:25px"><strong>E: </strong><a href="mailto:kobi@outbrain.com" target="_blank">kobi@outbrain.com</a></span></span>
</div>
</div>
<br></div>
</div>
<br>
<div><font size="1"><font face="Arial, Helvetica, sans-serif">The above terms reflect a potential business arrangement, are provided </font><font face="Arial, Helvetica, sans-serif">solely as a basis for further discussion, and are not intended to be and do </font><span style="font-family:Arial,Helvetica,sans-serif">not constitute a legally binding obligation. No legally binding obligations </span><span style="font-family:Arial,Helvetica,sans-serif">will be created, implied, or inferred until an agreement in final form is </span><span style="font-family:Arial,Helvetica,sans-serif">executed in writing by all parties involved.</span></font></div><div><font face="Arial, Helvetica, sans-serif" size="1"><br></font></div><div><font size="1"><font face="Arial, Helvetica, sans-serif">This email and any attachments hereto may be confidential or privileged. If you received this </font><span style="font-family:Arial,Helvetica,sans-serif">communication by mistake, please don't forward it to anyone else, please </span><span style="font-family:Arial,Helvetica,sans-serif">erase all copies and attachments, and please let me know that it has gone </span><span style="font-family:Arial,Helvetica,sans-serif">to the wrong person. Thanks.</span></font></div>