<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
If you want an example of a working response to Box, here is the
entire AttributeStatement we send them:<br>
<br>
<pre id="txt"> <saml2:AttributeStatement>
<saml2:Attribute FriendlyName="mail"
Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
>
<saml2:AttributeValue xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xs:string"
><a class="moz-txt-link-abbreviated" href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a></saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement></pre>
<br>
<br>
So we're just sending a mail attribute and nothing else.<br>
<br>
Curiously, I also noticed that we aren't sending any Subject/NameID
value:<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<pre id="txt"> <saml2:Subject>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="XXX.XXX.XXX.XXX"
InResponseTo="OaIrsDhsp8UJ2cKbG3QNIx8-u8Z"
NotOnOrAfter="2016-03-03T15:52:55.581Z"
Recipient=<a class="moz-txt-link-rfc2396E" href="https://sso.services.box.net/sp/ACS.saml2">"https://sso.services.box.net/sp/ACS.saml2"</a>
/>
</saml2:SubjectConfirmation>
</saml2:Subject></pre>
<br>
I suspect that that may be unintentional on the part of our IdP
guys, but either way would suggest that Box doesn't care about
NameID and all they really need is a 'mail' attribute.<br>
<br>
Fwiw, I checked and our setup is still using their 'box.net'
entityID, not the newer full URI one that someone mentioned.<br>
<br>
--Brent<br>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 3/3/16 10:04 AM, Chad Sutton wrote:<br>
</div>
<blockquote cite="mid:56D8526D.6070301@noctrl.edu" type="cite">Another
update. It seems that while mail is being passed, sn
(urn:oid:2.5.4.4) and givenName (urn:oid:2.5.4.42) aren't being
passed.
<br>
<br>
While I've gotten two different answers from them on what they
call "subject" (an earlier one that said they were using the ePPN
"urn:oid:1.3.6.1.4.1.5923.1.1.1.6" which was obviously wrong),
this is the latest info they have sent me.
<br>
<br>
first_name urn:oid:2.5.4.42 (Assertion)
<br>
subject urn:oid:1.3.6.1.4.1.5923.1.1.1.6 (Assertion)
<br>
last_name urn:oid:2.5.4.4 (Assertion)
<br>
<br>
As I'm still pretty new to all of this, it seems to me that as I
have never referenced "subject" in my config as
urn:oid:1.3.6.1.4.1.5923.1.1.1.6 that because I've assigned that
to the mail attributeID that it doesn't matter what the "friendly
name" of the attributeID is and that only the urn code is what is
being used. As I'm using the correct codes for "sn" and
"givenName" shouldn't they be passing too?
<br>
<br>
I feel like the crossed wires are on their end and not mine, but
being so new to this I'm not super confident about that yet.
<br>
<br>
Are these the same AttributeDefinitions others are using for Box?
<br>
<br>
<br>
Regards,
<br>
Chad Sutton - North Central College ITS
<br>
<a class="moz-txt-link-abbreviated" href="mailto:casutton@noctrl.edu">casutton@noctrl.edu</a>
<br>
630-637-5448
<br>
<br>
On 02/29/2016 09:25 AM, Chad Sutton wrote:
<br>
<blockquote type="cite">I'm at my wit's end here. We have an
existing Shib IDP that is working with a number of other SP's.
But we couldn't seem to get it working properly with Box.com. I
followed the wiki
<a class="moz-txt-link-freetext" href="https://spaces.internet2.edu/display/NetPlusIDG/BoxIDG">https://spaces.internet2.edu/display/NetPlusIDG/BoxIDG</a>.
<br>
<br>
I'm fairly new to Shibboleth so bare with me. Everything looks
like it is working except when it comes to passing Box the
eduPersonPrincipalName, which is really all that Box requires.
It doesn't pass anything to them. I noticed that the
PasswordProtectedTransport in my logs never contains any field
names like it does for other SPs.
<br>
<br>
I've have since created a test server so I can mess with XML
files and restart Tomcat as much as I want. I am getting the
same thing on the test box.
<br>
<br>
<br>
A snip from my idp-process.log
<br>
<br>
2016-02-29 08:38:38,745 - INFO
[net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] -
RemoteUserAuthServlet will process REMOTE_USER, along with
attributes [] and headers []
<br>
2016-02-29 08:39:59,781 - INFO
[org.ldaptive.auth.Authenticator:259] - Authentication succeeded
for dn: cn=casutton,ou=Admstr,ou=Napvil,o=NCC
<br>
2016-02-29 08:39:59,794 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
'casutton' succeeded
<br>
2016-02-29 08:40:00,327 - ERROR
[net.shibboleth.idp.profile.impl.ResolveAttributes:240] -
Profile Action ResolveAttributes: Error resolving attributes:
Invalid Attribute resolver configuration
<br>
2016-02-29 08:40:00,989 - WARN
[net.shibboleth.idp.consent.flow.ar.impl.AbstractAttributeReleaseAction:155]
- Profile Action PopulateAttributeReleaseContext: Unable to
locate attribute context
<br>
2016-02-29 08:40:02,513 - INFO [Shibboleth-Audit.SSO:241] -
20160229T144002Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|aTaVxkNsrMagR4Tsw3dkh5l-TGR|box.net|<a class="moz-txt-link-freetext" href="http://shibboleth.net/ns/profiles/saml2/sso/browser">http://shibboleth.net/ns/profiles/saml2/sso/browser</a>|<a class="moz-txt-link-freetext" href="https://logintest.noctrl.edu/idp/shibboleth">https://logintest.noctrl.edu/idp/shibboleth</a>|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f3849b289760d44449f9bfe62d6f459e|casutton|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxxxKquNVPpR5LnofTIk0ea6li7WEdmUEbq73t1trVyy0qmhwrpQqqRs93c3KvN2CKOCYhfPgpkI+m6tk9A3s0lgwRsyjjyWfzgPj5TKvI|_12beaf680eaf737d7b4d9ef639e27a4f|<br>
<br>
I'm assuming that this is a problem with my attribute-filter.xml
file? Here is what I have added for Box, which is direct from
the wiki page.
<br>
<br>
<AttributeFilterPolicy id="BoxSSO">
<br>
<PolicyRequirementRule
xsi:type="basic:AttributeRequesterString"
value=<a class="moz-txt-link-rfc2396E" href="https://services.box.com/sp">"https://services.box.com/sp"</a>/>
<br>
<AttributeRule attributeID="eduPersonPrincipalName">
<br>
<PermitValueRule xsi:type="basic:ANY"/>
<br>
</AttributeRule>
<br>
<AttributeRule attributeID="sn">
<br>
<PermitValueRule xsi:type="basic:ANY"/>
<br>
</AttributeRule>
<br>
<AttributeRule attributeID="givenName">
<br>
<PermitValueRule xsi:type="basic:ANY"/>
<br>
</AttributeRule>
<br>
</AttributeFilterPolicy>
<br>
<br>
Any ideas of where I need to focus to get this working? The Box
folks aren't much help. They expect everyone to figure this out
for themselves, which is fair I guess, but I imagine there are
tons of EDUs that use Shibboleth and Box. So I know this works.
:)
<br>
<br>
</blockquote>
<br>
<br>
</blockquote>
<br>
</body>
</html>