<div dir="ltr">Hi Teddy,<div><br></div><div>We had the same issue, basic SSO was working but not auto account creation. Our issue was solved by creating some very "simple" attributes just for WebEx. The problem was that WebEx doesn't understand the urn:oid naming scheme, rejects attributes that have "friendlyName" values, and demands that the name format be "unspecified."</div><div><br></div><div>For example, here is our normal mail attribute:</div><div><br></div><div><div><resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail"></div><div> <resolver:Dependency ref="myLDAP" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" /></div><div> </resolver:AttributeDefinition></div></div><div><br></div><div>Here's what the custom mail attribute for WebEx looks like:</div><div><br></div><div><div><resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExEmail" sourceAttributeID="mail"></div><div> <resolver:Dependency ref="myLDAP" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2String" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="email" /></div><div> </resolver:AttributeDefinition></div></div><div><br></div><div>Once we made these custom attributes, and ensured that we were only sending the four attributes they wanted (uid, firstname, lastname, email) auto account creation began working.</div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature">-------------------------------------------------------------<br>David Swartz<br><span style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Network/Systems Administrator</span><br><span style="font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Hamilton College - ITS Network Services</span><br>315.859.4918 , <a href="mailto:dswartz@hamilton.edu" target="_blank">dswartz@hamilton.edu</a><br>-------------------------------------------------------------</div></div>
<br><div class="gmail_quote">On Wed, Nov 4, 2015 at 1:36 PM, Sacilowski, Tadeusz <span dir="ltr"><<a href="mailto:ts2878@tc.columbia.edu" target="_blank">ts2878@tc.columbia.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi All,<div><br></div><div>We're also in the process of setting up WebEx to use our Shibboleth IdP. I've gotten SSO to work but am stuck at the auto account creation/update... any chance anyone is willing to share what they did for these?</div><div><br></div><div>Thank you,<br>Teddy</div></div><div class="gmail_extra"><br clear="all"><div><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><b><br></b></div><div dir="ltr"><b>Tadeusz Sacilowski</b><div><i style="font-size:small">Enterprise Architect & Security Engineer</i><i><br></i></div><div>Teachers College, Columbia University</div><div><a href="mailto:ts2878@tc.columbia.edu" target="_blank">ts2878@tc.columbia.edu</a></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Jul 23, 2015 at 4:29 PM, Mark Boyce <span dir="ltr"><<a href="mailto:Mark.Boyce@ucop.edu" target="_blank">Mark.Boyce@ucop.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><span style="color:#1f497d">Andrew,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">I would appreciate any guidance you may be able to provide…<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Thanks,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Mark<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#0070c0">Mark L. Boyce</span></b><span style="font-size:12.0pt;font-family:"Times New Roman","serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#7f7f7f">Senior Identity Management Analyst<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#7f7f7f">University of California, Office of the President<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#7f7f7f">415 20<sup>th</sup> Street<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#7f7f7f">Oakland, CA 94612
</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#7f7f7f">Office: <a href="tel:510.987.9681" value="+15109879681" target="_blank">510.987.9681</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:#7f7f7f">Cell: <a href="tel:209.851.0196" value="+12098510196" target="_blank">209.851.0196</a></span><span style="font-size:12.0pt;font-family:"Times New Roman","serif";color:#1f497d"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Todd, James<br>
<b>Sent:</b> Thursday, September 11, 2014 3:54 AM<span><br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: Shibboleth IdP with Webex<u></u><u></u></span></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#1f497d">Thank you all for your assistance – Andrew Martin provided some assistance off-list and some further tweaks mean I now have a working federated login with auto-account create. All down to encryption
of assertions in the end.<u></u><u></u></span></p><div><div>
<p class="MsoNormal"><span lang="EN-GB" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#1f497d">Cheers<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#1f497d">James<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-GB" style="font-size:10.0pt;color:navy">_____________________________________<br>
James Todd</span></b><span lang="EN-GB" style="font-size:10.0pt;color:navy"> | Data Centre & Operations Analyst</span><span lang="EN-GB" style="font-size:10.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:10.0pt;color:navy">Edinburgh Napier University</span></b><span lang="EN-GB" style="font-size:10.0pt;color:navy"><br>
Craiglockhart Campus<br>
Edinburgh<br>
EH14 1DJ</span><span lang="EN-GB" style="color:black">
</span><span lang="EN-GB" style="font-size:12.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;color:navy">Tel: 0131 455 4313<br>
Email: <a href="mailto:j.todd@napier.ac.uk" target="_blank"><span style="color:blue">j.todd@napier.ac.uk</span></a></span><span lang="EN-GB" style="color:black"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span lang="EN-GB" style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span>From:</span></b><span>
<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net" target="_blank">mailto:users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Todd, James<br>
<b>Sent:</b> 10 September 2014 09:43<br>
<b>To:</b> <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a><br>
<b>Subject:</b> Shibboleth IdP with Webex<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Hi Group,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">I’d like some guidance primarily from those who have already got Shib and Webex working together here as I gather from other posts I’ve seen it’s not entirely straightforward as other setups.
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">I’ve been trying to federate with Webex using our 2.3.8 IdP, using the documentation provided by Cisco (which seems heavily geared towards helping those using ADFS) and I’m hitting a brick wall. I’ve added the Webex metadata,
I’ve pulled together the required attributes in the resolver (uid, email, firstname, lastname) and configured a webex nameid and used the uid for that. I’ve configured the attribute filter to remove all the unwanted attributes we usually release as default
for other SPs. I’ve configured the webex side to point at our IdP, I’ve added our IdP metadata and all that good stuff.<u></u><u></u></span></p>
<p><span lang="EN-GB" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">So when it comes to Webex login it correctly redirects to our IdP and our IdP redirects back to Webex, from the logs I can see the attributes I want sent are being sent - but
webex fails to login with the error “<b><span style="color:red">Reason: </span>
</b><span style="color:red">Invalid Response message (29)” </span>obviously that means that something’s wrong with my assertion but the documentation is of no help and as I’ve already said geared heavily to an ADFS implementation.<u></u><u></u></span></p>
<p><span lang="EN-GB" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">So, has anybody already successfully done this, and do they have any pointers?<u></u><u></u></span></p>
<p><span lang="EN-GB" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Cheers<u></u><u></u></span></p>
<p><span lang="EN-GB" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">James<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-GB" style="font-size:10.0pt;color:navy">_____________________________________<br>
James Todd</span></b><span lang="EN-GB" style="font-size:10.0pt;color:navy"> | Data Centre & Operations Analyst</span><span lang="EN-GB" style="font-size:10.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:10.0pt;color:navy">Edinburgh Napier University</span></b><span lang="EN-GB" style="font-size:10.0pt;color:navy"><br>
Craiglockhart Campus<br>
Edinburgh<br>
EH14 1DJ</span><span lang="EN-GB" style="color:black">
</span><span lang="EN-GB" style="font-size:12.0pt;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;color:navy">Tel: 0131 455 4313<br>
Email: <a href="mailto:j.todd@napier.ac.uk" target="_blank"><span style="color:blue">j.todd@napier.ac.uk</span></a></span><span lang="EN-GB" style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="font-size:10.0pt;color:red">** IT Support is now available 24 hrs a day, 365 days of the year **<u></u><u></u></span></b></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt">For Help and Advice on any of our IT services please visit:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt">Staff Intranet:
<span style="color:#1f497d"><a href="http://staff.napier.ac.uk/services/cit/Pages/info-services.aspx" target="_blank"><span style="color:blue">http://staff.napier.ac.uk/services/cit/Pages/info-services.aspx</span></a><u></u><u></u></span></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt">Student Portal:
<span style="color:#1f497d"><a href="https://studentportal.napier.ac.uk/citservices/default.aspx" target="_blank"><span style="color:blue">https://studentportal.napier.ac.uk/citservices/default.aspx</span></a><u></u><u></u></span></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt"><img border="0" width="113" height="163" src="cid:image001.jpg@01D0C54B.8FAB6D60" alt="CSE logo 2014"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
</div></div></div>
</div>
<br><span class="HOEnZb"><font color="#888888">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></font></span></blockquote></div><br></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>