<div dir="ltr">We have had Blackboard Transact functioning with the Shibboleth IdP V3 for a while now. Hope this helps.<div><br><div>To elaborate on the response by Michael:<div><br></div><div><u>Relying Party Overrides:</u><br></div><div>The metadata they provided contains information on 3 different Service Providers. It was necessary to create relying party overrides for each of them. Note the need to add in the SAML2.AttributeQuery profile as well due to their use of the follow-up query.</div><div><div><i><font size="1"> <!-- Custom Blackboard Relying Party 1 --></font></i></div><div><i><font size="1"> <bean parent="RelyingPartyByName" c:relyingPartyIds="<Your Custom Blackboard EntityID 1"></font></i></div><div><i><font size="1"> <property name="profileConfigurations"></font></i></div><div><i><font size="1"> <list></font></i></div><div><i><font size="1"> <span class="" style="white-space:pre"> </span><bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptAttributes="false" p:encryptNameIDs="false" p:signResponses="false" p:signAssertions="false" /></font></i></div><div><i><font size="1"> <span class="" style="white-space:pre"> </span><bean parent="SAML2.AttributeQuery" /></font></i></div><div><i><font size="1"> </list></font></i></div><div><i><font size="1"> </property></font></i></div><div><i><font size="1"> </bean></font></i></div></div><div><br></div><div><div><div><u>Custom Attributes:</u></div><div>Their system does not use standard attributes. They have custom attribute names that must match (bb_email, bb_givenName, bb_middleName, bb_lastName, bb_userName, bb_customerCardNumber, bb_customerNumber).</div><div>New attribute resolver definitions were needed to provide these for release to all three of their service providers, for example:</div></div><div><div><i><font size="1"> <resolver:AttributeDefinition xsi:type="ad:Scoped" scope="%{idp.scope}" id="bb_email" sourceAttributeID="samaccountname"></font></i></div><div><i><font size="1"> <resolver:Dependency ref="myLDAP" /></font></i></div><div><i><font size="1"> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:mail" /></font></i></div><div><i><font size="1"> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="BbSPEmailAddress" /></font></i></div><div><i><font size="1"> </resolver:AttributeDefinition></font></i></div></div></div><div><i><font size="1"><br></font></i></div><div><i><font size="1"><br></font></i></div><div><u>Restrict Default Attribute Release:</u><i><font size="1"><br></font></i></div><div>It was necessary to exclude their service providers from the release of default attributes that have been configured to be released to any registered SP. Their system could not handle the extra data.<br></div><div><div><i><font size="1"> <!-- Attributes released to any SP --></font></i></div><div><i><font size="1"> <afp:AttributeFilterPolicy id="releaseToAnyone"></font></i></div><div><i><font size="1"> <afp:PolicyRequirementRule xsi:type="basic:NOT"></font></i></div><div><i><font size="1"> <basic:Rule xsi:type="basic:OR"></font></i></div></div><div><div><i><font size="1"> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<Your Custom Blackboard EntityID 1" /></font></i></div><div><i><font size="1"> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<Your Custom Blackboard EntityID 2" /></font></i></div><div><i><font size="1"> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<Your Custom Blackboard EntityID 3" /></font></i></div></div></div></div><div><div><i><font size="1"> </basic:Rule></font></i></div><div><i><font size="1"> </afp:PolicyRequirementRule></font></i></div><div><i><font size="1"> <afp:AttributeRule attributeID="defaultAttribute1" permitAny="true"/></font></i></div><div><i><font size="1"> <afp:AttributeRule attributeID="defaultAttribute2" permitAny="true"/></font></i></div><div><i><font size="1"> </afp:AttributeFilterPolicy></font></i><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1"><span></span></font>
<hr>
<font face="Arial" size="1"><span></span></font><b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">James Gross</span></b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">
<span>| Enterprise Application and </span>CMS Developer</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'"> (Enterprise Web Services)<br>
</span>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">UNC Charlotte
<span>| </span>Information Technology Services</span></p>
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">9201 University City Blvd.
<span>| </span>Charlotte, NC 28223</span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">Phone: 704-687-0298
<span>| Office: Kennedy 301-C39</span></span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="mailto:jgross15@uncc.edu" target="_blank">jgross15@uncc.edu</a>
</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">|
</span><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="http://www.uncc.edu" target="_blank">http://www.uncc.edu</a></span></p>
<span style="color:black;font-family:'Arial','sans-serif'"></span></font>
<hr>
<font face="Arial" size="1"><span style="color:black;font-family:'Arial','sans-serif'">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">If
you are not the intended recipient of this transmission or a person
responsible for delivering it to the intended recipient, any disclosure,
copying, distribution, or other use of any of the information in this
transmission is strictly prohibited. If you have received this
transmission in error, please notify me immediately by reply e-mail or
by telephone at 704-687-0298. Thank you.</span></p>
</span></font>
<p> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Mar 28, 2016 at 10:03 PM, Michael A Grady <span dir="ltr"><<a href="mailto:mgrady@unicon.net" target="_blank">mgrady@unicon.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><br>
> On Mar 28, 2016, at 3:49 PM, Cantor, Scott <<a href="mailto:cantor.2@OSU.EDU">cantor.2@OSU.EDU</a>> wrote:<br>
><br>
>> Ok, good to know. I really don’t know how they’re differentiating between<br>
>> IdP 2 and 3, or what their actual requirements are. Based on this thread, I’m<br>
>> hoping someone else has some experience with what exactly is needed to<br>
>> get Bb Transact working, as they don’t seem to know much themselves.<br>
><br>
> My point is that of the three possible issues, two of them are trivial for anybody to test out. The third means they have a bug and there's nothing you can do to fix it. Nailing down which of those is involved is not really something you need them to do.<br>
><br>
> -- Scott<br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
</div></div>Unless Blackboard Transact has changed something since I helped an institution integrate with them in fall of 2014 (one would hope they have evolved their SAML implementation), the following were true then:<br>
<br>
- their requirements involved having to match the actual FriendlyName to their needs, they did not use the real on-the-wire attribute names<br>
<br>
- they don't take your IdP's certificate, which means they can't verify the signature on the response, and thus there is *no* security on the SAMLv2 response you send them. Which is also why (one surmises) they only accepted a Transient or CryptoTransient NameID.<br>
<br>
- so even if you send a bunch of attributes on the front-channel, they *will* send a backchannel Attribute Query, because the TLS verification there is the thing that provides security around your "SAML interaction" with them<br>
<br>
- the cert you present for the backchannel needs to have in it the name under which they are accessing the server. I don't think it needs to be a CA-issued cert, but I don't recall what we ended up having actually working. It took a number of tries, and there is no access to any logs on their (Blackboard's side) as to what is happening on their end.<br>
<br>
--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.<br>
<br>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div></div>