<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>I had it working for IDM 4.5.2 and Shibboleth IdP v3. I had first messed this up when moving to Shib IdP v3 as I had missed that the assertion was signed and not the SAML2Response. I had commented on the bottom of the blog post here <a href="https://www.netiq.com/communities/cool-solutions/configuring-idm-4-5s-osp-talk-shibboleth-idp/">https://www.netiq.com/communities/cool-solutions/configuring-idm-4-5s-osp-talk-shibboleth-idp/</a> and
stated how I got it working as well.</div>
<div><br>
</div>
<div>The issue is that they made some significant changes with IDM 4.5.3 and moved to OSP 6.0.0 from OSP 5.x. I created a NetIQ forum post on the issue and it can be read here: <a href="https://forums.netiq.com/showthread.php?55302-Non-NAM-SAML-IDP-and-OSP-6-0">https://forums.netiq.com/showthread.php?55302-Non-NAM-SAML-IDP-and-OSP-6-0</a></div>
<div><br>
</div>
<div>To summarize the issue, they extract the SAML Assertion and incorrectly try to clean namespace declarations on the signed assertion after it was initially verified. They used this extracted SAML Assertion later in the process and it no longer verifies
because of the changes to the Assertion.</div>
<div><br>
</div>
</div>
<div><br>
</div>
<div>-Bradley</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of David Gersic <<a href="mailto:dgersic@niu.edu">dgersic@niu.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Users Shib <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, February 16, 2016 at 8:20 AM<br>
<span style="font-weight:bold">To: </span>Users Shib <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Novell/NetIQ IDM and Shibboleth<br>
</div>
<div><br>
</div>
<div><style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Asking some friends, I'm told that this does work, or at least can be made to work, with IdP v3. I'm still acquiring the details as to what needs to be done, though.<br>
</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri,sans-serif" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Liam Hoekenga <<a href="mailto:liamr@umich.edu">liamr@umich.edu</a>><br>
<b>Sent:</b> Monday, February 15, 2016 9:40 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Novell/NetIQ IDM and Shibboleth</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Feb 15, 2016 at 10:24 AM, David Gersic <span dir="ltr">
<<a href="mailto:dgersic@niu.edu" target="_blank">dgersic@niu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<p>NIU is a long time user of MicroFocus (was NetIQ, was Novell) eDirectory and Identity Manager. We're also using Shibboleth here. They go quite well together, IMHO. We aren't using OSP here, but a friend has written an article on how to get OSP to work with
Shibboleth (<a title="Ctrl+Click or tap to follow the link" href="https://www.netiq.com/communities/cool-solutions/configuring-idm-4-5s-osp-talk-shibboleth-idp/" target="_blank">https://www.netiq.com/communities/cool-solutions/configuring-idm-4-5s-osp-talk-shibboleth-idp/</a>),
so maybe that's an option for you.</p>
</blockquote>
</div>
<br>
I was talking to Brad about this off-list, and apparently there's a change between the OSP in 4.5.2 and 4.5.3 that breaks things:</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra"> From 4.5 through 4.5.2 Shibboleth IDP worked by virtue of the SAML2 support, but in 4.5.3 it breaks</div>
<div class="gmail_extra"> from a bug. Since NAM is their only supported IDP, and the bugI found is not a problem in NAM, but</div>
<div class="gmail_extra"> it is a problem with Shibboleth, they are not considering it a bug that needs to be fixed.<br>
</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Liam</div>
</div>
</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>