<div dir="ltr"><span style="font-size:13.3333339691162px">Hi, David. This is actually 1 domain in google (primary domain is : </span><a href="http://dev.mysitea.ca/" target="_blank" style="font-size:13.3333339691162px">dev.mySiteA.ca</a><span style="font-size:13.3333339691162px">) with a subdomain </span><a href="http://dev.mysiteb.com/" target="_blank" style="font-size:13.3333339691162px">dev.mySiteB.com</a><span style="font-size:13.3333339691162px">.</span><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">By the way I got it working. Here are the relevant pieces for those who are interested:</div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">attribute-filter.xml:<br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div> &lt;afp:AttributeFilterPolicy id=&quot;doNotReleaseTransientIdToAnyoneGoogleMySiteA&quot;&gt;</div><span class="im">  &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:NOT&quot;&gt;</span><div>    &lt;basic:Rule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;<a href="http://mail.google.com/a/dev.mySiteA.ca" target="_blank">mail.google.com/a/dev.mySiteA.ca</a>&quot; /&gt;</div><span class="im"><div>  &lt;/afp:PolicyRequirementRule&gt;</div><div>   &lt;afp:AttributeRule attributeID=&quot;transientId&quot;&gt;</div><div>    &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot; /&gt;</div><div>  &lt;/afp:AttributeRule&gt;</div><div>&lt;/afp:AttributeFilterPolicy&gt;</div></span></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div>&lt;afp:AttributeFilterPolicy id=&quot;releaseTransientIdToAnyoneGoogleMySiteB&quot;&gt;</div><span class="im">  &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:NOT&quot;&gt;</span><div>    &lt;basic:Rule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;<a href="http://mail.google.com/a/dev.mySiteB.com" target="_blank">mail.google.com/a/dev.mySiteB.com</a>&quot; /&gt;</div><span class="im"><div>  &lt;/afp:PolicyRequirementRule&gt;</div><div>  &lt;afp:AttributeRule attributeID=&quot;transientId&quot;&gt;</div><div>    &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot; /&gt;</div><div>  &lt;/afp:AttributeRule&gt;</div><div>&lt;/afp:AttributeFilterPolicy&gt;</div></span></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div> &lt;afp:AttributeFilterPolicy id=&quot;releaseGoogleMySiteAEmail&quot;&gt;</div><div>  &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;<a href="http://google.com/a/dev.mySiteA.ca" target="_blank">google.com/a/dev.mySiteA.ca</a>&quot;/&gt;</div><div>  &lt;afp:AttributeRule attributeID=&quot;GoogleMySiteAEmail&quot;&gt;</div><span class="im"><div>    &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot; /&gt;</div><div>  &lt;/afp:AttributeRule&gt;</div><div>&lt;/afp:AttributeFilterPolicy&gt;</div></span></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div> &lt;afp:AttributeFilterPolicy id=&quot;releaseGoogleMySiteBEmail&quot;&gt;</div><div>  &lt;afp:PolicyRequirementRule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;<a href="http://google.com/a/dev.mySiteB.com" target="_blank">google.com/a/dev.mySiteB.com</a>&quot;/&gt;</div><div>  &lt;afp:AttributeRule attributeID=&quot;GoogleMySiteBEmail&quot;&gt;</div><span class="im"><div>    &lt;afp:PermitValueRule xsi:type=&quot;basic:ANY&quot; /&gt;</div><div>  &lt;/afp:AttributeRule&gt;</div><div>&lt;/afp:AttributeFilterPolicy&gt;</div></span></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">--------------------</div><div style="font-size:13.3333339691162px">attribute-resolver.xml :</div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div>&lt;resolver:AttributeDefinition xsi:type=&quot;Simple&quot; xmlns=&quot;urn:mace:shibboleth:2.0:resolver:ad&quot; id=&quot;GoogleMySiteAEmail&quot; sourceAttributeID=&quot;mail&quot;&gt;</div><span class="im"><div> &lt;resolver:Dependency ref=&quot;myLDAP&quot; /&gt;</div><div>   &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML1StringNameIdentifier&quot; nameFormat=&quot;urn:mace:shibboleth:1.0:nameIdentifier&quot;/&gt;</div></span><div>  &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML2StringNameID&quot; nameFormat=&quot;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&quot;/&gt;</div><div>&lt;/resolver:AttributeDefinition&gt;</div></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div>&lt;resolver:AttributeDefinition xsi:type=&quot;Simple&quot; xmlns=&quot;urn:mace:shibboleth:2.0:resolver:ad&quot; id=&quot;GoogleMySiteBEmail&quot; sourceAttributeID=&quot;mail&quot;&gt;</div><span class="im"><div> &lt;resolver:Dependency ref=&quot;myLDAP&quot; /&gt;</div><div>   &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML1StringNameIdentifier&quot; nameFormat=&quot;urn:mace:shibboleth:1.0:nameIdentifier&quot;/&gt;</div></span><div>  &lt;resolver:AttributeEncoder xsi:type=&quot;enc:SAML2StringNameID&quot; nameFormat=&quot;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&quot;/&gt;</div><div>&lt;/resolver:AttributeDefinition&gt;</div></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><span class="im"><div> &lt;resolver:DataConnector id=&quot;myLDAP&quot; xsi:type=&quot;dc:LDAPDirectory&quot;</div><div>        ldapURL=&quot;ldap://<a href="http://1.2.3.4:389/" target="_blank">1.2.3.4:389</a>&quot; </div></span><div>        baseDN=&quot;ou=users,o=mycompany&quot; </div><span class="im"><div>        principal=&quot;cn=loginuser,ou=users,o=myCompany&quot;</div><div>        principalCredential=&quot;mypassword&quot;&gt;</div><div>        &lt;dc:FilterTemplate&gt;</div><div>            &lt;![CDATA[</div><div>                (cn=$requestContext.principalName)</div><div>            ]]&gt;</div><div>        &lt;/dc:FilterTemplate&gt;</div></span><div>    &lt;!--    </div><div>    &lt;ReturnAttributes&gt;cn&lt;/ReturnAttributes&gt;</div><div>    --&gt;</div><div>    </div><div>    &lt;/resolver:DataConnector&gt;</div></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">-----------------------</div><div style="font-size:13.3333339691162px">relying-party.xml :</div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div> &lt;rp:RelyingParty id=&quot;<a href="http://google.com/a/dev.mySiteA.ca" target="_blank">google.com/a/dev.mySiteA.ca</a>&quot;</div><span class="im"><div>        provider=&quot;<a href="https://idp.mycompany.com/idp/shibboleth" target="_blank">https://idp.mycompany.com/idp/shibboleth</a>&quot;</div><div>        defaultSigningCredentialRef=&quot;IdPCredential&quot;&gt;</div><div>    &lt;rp:ProfileConfiguration xsi:type=&quot;saml:SAML2SSOProfile&quot; encryptAssertions=&quot;never&quot; encryptNameIds=&quot;never&quot; /&gt;    </div><div>&lt;/rp:RelyingParty&gt; </div></span></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div>&lt;rp:RelyingParty id=&quot;<a href="http://google.com/a/dev.mySiteB.com" target="_blank">google.com/a/dev.mySiteB.com</a>&quot;</div><span class="im"><div>        provider=&quot;<a href="https://idp.mycompany.com/idp/shibboleth" target="_blank">https://idp.mycompany.com/idp/shibboleth</a>&quot;</div><div>        defaultSigningCredentialRef=&quot;IdPCredential&quot;&gt;</div><div>    &lt;rp:ProfileConfiguration xsi:type=&quot;saml:SAML2SSOProfile&quot; encryptAssertions=&quot;never&quot; encryptNameIds=&quot;never&quot; /&gt;    </div><div>&lt;/rp:RelyingParty&gt; </div></span></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div>  &lt;metadata:MetadataProvider xsi:type=&quot;FilesystemMetadataProvider&quot; xmlns=&quot;urn:mace:shibboleth:2.0:metadata&quot; id=&quot;GoogleMySiteAMD&quot; metadataFile=&quot;/opt/shibboleth-idp/metadata/googleMySiteAdev-metadata.xml&quot; /&gt;</div><div>    </div></div><div style="font-size:13.3333339691162px">  &lt;metadata:MetadataProvider xsi:type=&quot;FilesystemMetadataProvider&quot; xmlns=&quot;urn:mace:shibboleth:2.0:metadata&quot; id=&quot;GoogleMySiteBMD&quot; metadataFile=&quot;/opt/shibboleth-idp/metadata/googleMySiteBdev-metadata.xml&quot; /&gt;<br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">------------</div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">googleMySiteAdev-metadata.xml:</div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div>&lt;EntityDescriptor entityID=&quot;<a href="http://google.com/a/dev.MySiteA.ca" target="_blank">google.com/a/dev.MySiteA.ca</a>&quot; xmlns=&quot;urn:oasis:names:tc:SAML:2.0:metadata&quot;&gt;</div><span class="im">    &lt;SPSSODescriptor protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</span><div>        &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&lt;/NameIDFormat&gt;</div><span class="im">        &lt;AssertionConsumerService index=&quot;1&quot; Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&quot;</span><div>            Location=&quot;<a href="https://www.google.com/a/dev.mySiteA.ca/acs" target="_blank">https://www.google.com/a/dev.mySiteA.ca/acs</a>&quot; /&gt;</div><div>    &lt;/SPSSODescriptor&gt;</div><div>&lt;/EntityDescriptor&gt;</div></div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">----------------------</div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px">googleMySiteBdev-metadata.xml:</div><div style="font-size:13.3333339691162px"><br></div><div style="font-size:13.3333339691162px"><div>&lt;EntityDescriptor entityID=&quot;<a href="http://google.com/a/dev.mySiteB.com" target="_blank">google.com/a/dev.mySiteB.com</a>&quot; xmlns=&quot;urn:oasis:names:tc:SAML:2.0:metadata&quot;&gt;</div><span class="im">    &lt;SPSSODescriptor protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</span><div>        &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress&lt;/NameIDFormat&gt;</div><span class="im">        &lt;AssertionConsumerService index=&quot;1&quot; Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&quot;</span><div>            Location=&quot;<a href="https://www.google.com/a/dev.mySiteBl.com/acs" target="_blank">https://www.google.com/a/dev.mySiteBl.com/acs</a>&quot; /&gt;</div><div>    &lt;/SPSSODescriptor&gt;</div><div>&lt;/EntityDescriptor&gt;</div></div><div class="" style="font-size:13.3333339691162px"></div></div>