<div dir="ltr">We had to create a new RelyingParty entry specifically for WebEx so that we could disable encrypting assertions.<div><br></div><div>Here is the entry we added, note that I have obfuscated the ID and provider links. </div><div><br></div><div><div> <rp:RelyingParty id="<a href="https://whatever.webex.com">https://whatever.webex.com</a>" provider="<a href="https://MyShibSite.edu/idp/shibboleth">https://MyShibSite.edu/idp/shibboleth</a>" defaultSigningCredentialRef="IdPCredential" defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"></div><div><span class="" style="white-space:pre"> </span></div><div> </div><div> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true" </div><div> assertionLifetime="PT3M" assertionProxyCount="0" </div><div> signResponses="conditional" signAssertions="always" </div><div> encryptAssertions="never" encryptNameIds="never"/></div><div><br></div><div> <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" includeAttributeStatement="true" </div><div> assertionLifetime="PT3M" assertionProxyCount="0" </div><div> signResponses="conditional" signAssertions="always" </div><div> encryptAssertions="never" encryptNameIds="never"/></div><div><br></div><div> <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" </div><div> assertionLifetime="PT3M" assertionProxyCount="0" </div><div> signResponses="conditional" signAssertions="never" </div><div> encryptAssertions="never" encryptNameIds="never"/></div><div> </div><div> <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" </div><div> signResponses="conditional" signAssertions="always" </div><div> encryptAssertions="never" encryptNameIds="never"/></div><div><br></div><div> <rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"</div><div> signResponses="conditional"/></div><div><span class="" style="white-space:pre"> </span> </div><div><span class="" style="white-space:pre"> </span></rp:RelyingParty></div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature">-------------------------------------------------------------<br>David Swartz<br><span style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Network/Systems Administrator</span><br><span style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Hamilton College - ITS Network Services</span><br>315.859.4918 , <a href="mailto:dswartz@hamilton.edu" target="_blank">dswartz@hamilton.edu</a><br>-------------------------------------------------------------</div></div>
<br><div class="gmail_quote">On Tue, Nov 3, 2015 at 3:48 PM, Eric Wedaa <span dir="ltr"><<a href="mailto:Eric.Wedaa@marist.edu" target="_blank">Eric.Wedaa@marist.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">How did you configure your metadataProvider without editing relying-party.xml?<br>
<br>
Errors: For instance <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider</a> says:<br>
<MetadataProvider xsi:type="FilesystemMetadataProvider"<br>
id="InternalMetadata"<br>
metadataFile="/path/to/my/metadata-internal.xml" /><br>
But the error log says :<br>
15:16:44.696 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.RelyingPartyConfigurationManager service, error creating components. The root cause of this error was: org.xml.sax.SAXParseException: cvc-elt.4.2: Cannot resolve 'FilesystemMetadataProvider' to a type definition for element 'metadata:MetadataProvider'.<br>
<br>
So either I messed up something, or the docs are wrong.<br>
<br>
Thanks1<br>
<br>
>>Ericw<br>
<br>
-----"users" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> wrote: -----<br>
To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
From: Christopher Bongaarts<br>
Sent by: "users"<br>
Date: 11/03/2015 03:41PM<br>
Subject: Re: IDP 2.5.0 relying-party.xml file for Cisco WebEx?<br>
<br>
On 11/3/2015 2:35 PM, Eric Wedaa wrote:<br>
> Does anybody have a working relying-party.xml file for Shibboleth IDP 2.5.0 that works for Cisco WebEx?<br>
><br>
> I have beat my head against the wall and, while having found several webpages that claim to tell you how to do it, none of them have worked. I can get my IDP to talk to Shibboleth SPs and testshib. All my attempts have spewed tomcat errors telling me that my relying-party.xml file is wrong.<br>
<br>
We did not have to make any changes to relying-party.xml to get WebEx<br>
working.<br>
<br>
We did have to define a bunch of extra attributes, since they require<br>
non-standard attribute names, and autoprovisioning fails spectacularly<br>
if your given name attribute is empty or only consists of whitespace (we<br>
hard code a "-" as the WebEx given name for accounts that lack one,<br>
using a scripted attribute).<br>
<br>
If your tomcat logs indicate relying-party errors, there should be an<br>
indication of what the problem is (if not in the Tomcat logs, in the<br>
Shibboleth idp-process.log).<br>
<br>
--<br>
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu">cab@umn.edu</a> %%<br>
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" rel="noreferrer" target="_blank">http://umn.edu/~cab</a> %%<br>
%% University of Minnesota %% <a href="tel:%2B1%20%28612%29%20625-1809" value="+16126251809">+1 (612) 625-1809</a> %%<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>