<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Nate,</p>
<p><br>
</p>
<p>Thank you for all your advice. I was able to successfully authenticate with the Freshdesk SSO!</p>
<p>However, I can't fully authenticate for my user attributes are encrypted and Freshdesk is not decrypting them before processing the information.</p>
<p><br>
</p>
<p>In my logs I can see I am getting the correct data from my ldap data connector. I then send the data to Freshdesk with this RelyingParty:</p>
<p><br>
</p>
<p class="p1"><font color="#006fc9"><span class="s1"><bean </span><span class="s2">parent</span><span class="s3">=</span><span class="s4">"RelyingPartyByName"</span><span class="s1">
</span><span class="s2">c</span><span class="s5">:</span><span class="s2">relyingPartyIds</span><span class="s3">=</span><span class="s4">"https://psdts.freshdesk.com/login/saml"</span><span class="s1">></span></font></p>
<p class="p1"><font color="#006fc9"><span class="s3"> </span><span class="s1"><property
</span><span class="s2">name</span><span class="s3">=</span><span class="s4">"profileConfigurations"</span><span class="s1">></span></font></p>
<p class="p2"><font color="#006fc9"><span class="s4"> </span><span class="s1"><list></span></font></p>
<p class="p3"><font color="#006fc9"><span class="s3"> </span><span class="s1"><bean
</span><span class="s4">parent</span><span class="s3">=</span><span class="s6">"SAML2.SSO"</span><span class="s1">
</span><span class="s4">p</span><span class="s5">:</span><span class="s4">encryptAssertions</span><span class="s3">=</span><span class="s6">"false"</span><span class="s1"> /></span></font></p>
<p class="p2"><font color="#006fc9"><span class="s4"> </span><span class="s1"></list></span></font></p>
<p class="p2"><font color="#006fc9"><span class="s4"> </span><span class="s1"></property></span></font></p>
<p></p>
<p class="p2"><span class="s1"><font color="#006fc9"></bean></font></span></p>
<p class="p2"><span class="s1"><font color="#006fc9"><br>
</font></span></p>
<p class="p2">I am only able to authenticate with encryptAssertions set to false.</p>
<p class="p2"><br>
</p>
<p class="p2">In my logs I am sending this data: </p>
<p class="p1"><span class="s1"><font color="#006fc9">20150810T161801Z|urn:mace:shibboleth:2.0:profiles:AuthnRequest|_099e8133-b076-4619-8c5e-7b9e12b9403f|https://psdts.freshdesk.com/login/saml|http://shibboleth.net/ns/profiles/saml</font></span></p>
<p class="p1"><span class="s1"><font color="#006fc9">2/sso/browser|https://idp.psd401.net/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_de8df0b4d8a4b113b68ae69b5318d8d5|martinb|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|email,givenname|AAdzZWNyZXQxWjx</font></span></p>
<p></p>
<p class="p1"><span class="s1"><font color="#006fc9">kJgQXriaalUPiVnhTsAPpLgNCDOsoFHgeRpknaFmi8yXR2AgZH+w01z6aRdPM2a7zUoB2HElqRVz0tDNNfmIlXBGpABYoR1hSBCB1WXn/5FdaV3Ba9/BcyrfwflMFv5Ujdx0Mt28EU+x/|_fae5fa2c6a4c578cb3fa03cfed4d5904</font></span></p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<p class="p1"><b><br>
</b></p>
<p class="p1">Then in the Freshdesk interface after I log in, it says my email is <span style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 12pt;">AAdzZWNyZXQxWjx</span></p>
<p style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols;">
</p>
<p class="p1" style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols;">
<span class="s1">kJgQXriaalUPiVnhTsAPpLgNCDOsoFHgeRpknaFmi8yXR2AgZH+w01z6aRdPM2a7zUoB2HElqRVz0tDNNfmIlXBGpABYoR1hSBCB1WXn/5FdaV3Ba9/BcyrfwflMFv5Ujdx0Mt28EU+x/. </span></p>
<p class="p1" style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols;">
<span class="s1"><br>
</span></p>
<p class="p1" style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols;">
<span class="s1">I've tried several solutions from the internet without the result changing. From toying with </span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">md:NameIDFormat in the metadata to trying different options
in the relaying party. </span></p>
<p class="p1" style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols;">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></p>
<p class="p1" style="font-family: Calibri, Arial, Helvetica, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols;">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Thank you</span></p>
<p class="p1"><b><br>
</b></p>
<p class="p1"><b><br>
</b></p>
<p class="p1"><b>Brandon Martin</b></p>
<p class="p1">martinb@psd401.net</p>
<p class="p1">Peninsula School District</p>
<p class="p1"><i>Data Integration Analyst</i></p>
<p class="p1"></p>
<p class="p1">Ext: 3712</p>
</div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block; width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Nate Klingenstein <ndk@internet2.edu><br>
<b>Sent:</b> Saturday, August 8, 2015 11:02 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Freshdesk SSO</font>
<div> </div>
</div>
<div>Brandon,
<div class=""><br class="">
</div>
<div class="">
<div>
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" class="" style="font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; font-size:12pt; background-color:rgb(255,255,255); font-family:Calibri,Arial,Helvetica,sans-serif">
That helps tremendously. I have been testing with the fingerprint of my encryption certificate. In the service it says the SHA-1 is the encryption<span class="Apple-converted-space"> </span><i class="">and<span class="Apple-converted-space"> </span></i>signing
certificate.</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>It’s possible to use different certificates for encryption and signature. It wasn’t a common case prior to the release of IdPv3, but I think they were probably trying to accommodate that. As an IdP, your signing certificate is almost always the relevant
one.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" class="" style="font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; font-size:12pt; background-color:rgb(255,255,255); font-family:Calibri,Arial,Helvetica,sans-serif">
Does this mean in the metadata I include both xml objects to link signature and encryption as the same values as my X.509 signing certificate?</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>If I were to guess and reword this as “does this mean that I should enter my signing certificate’s SHA-1 hash into the fields on their webpage”, then I would say yes. I’m not quite sure how to interpret your question as stated.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" class="" style="font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; font-size:12pt; background-color:rgb(255,255,255); font-family:Calibri,Arial,Helvetica,sans-serif">
In other words, I tell my metadata-less friends about my encryption and singing certificates but they are both actually the cat of my signing certificate.</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Well, the hash isn’t just the entire base64-encoded printed raw value. It’s a specific field. You can find that field using tools like openssl.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div id="divtagdefaultwrapper" class="" style="font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px; font-size:12pt; background-color:rgb(255,255,255); font-family:Calibri,Arial,Helvetica,sans-serif">
My browser certificate will be different than my IDP certificate. I am behind a load balancer that provides https certs, is this a problem?<span class="Apple-converted-space"> </span><br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<div class="">No, generally it’s a good thing because it gives you more flexibility in management of each certificate and won’t need to roll over your IdP certificate with frequency. It’s a deployment decision, though.</div>
<div class=""><br class="">
</div>
<div class="">Take care,</div>
<div class="">Nate.</div>
</div>
</div>
</div>
</body>
</html>