<div dir="ltr">Alan,<div>Did you include the AttributeQuery/SOAP profile in the relying party overrides as well? That was the sticking point for me that took a while to figure out. </div><div><br></div><div><div style="font-size:12.8px"><i><font size="1"><!-- Custom Blackboard Relying Party 1 --></font></i></div><div style="font-size:12.8px"><i><font size="1"> <bean parent="RelyingPartyByName" c:relyingPartyIds="<Your Custom Blackboard EntityID 1"></font></i></div><div style="font-size:12.8px"><i><font size="1"> <property name="profileConfigurations"></font></i></div><div style="font-size:12.8px"><i><font size="1"> <list></font></i></div><div style="font-size:12.8px"><i><font size="1"> <span style="white-space:pre-wrap"> </span><bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptAttributes="false" p:encryptNameIDs="false" p:signResponses="false" p:signAssertions="false" /></font></i></div><div style="font-size:12.8px"><i><font size="1"> <span style="white-space:pre-wrap"> </span><b><bean parent="SAML2.AttributeQuery" /></b></font></i></div><div style="font-size:12.8px"><i><font size="1"> </list></font></i></div><div style="font-size:12.8px"><i><font size="1"> </property></font></i></div><div style="font-size:12.8px"><i><font size="1"> </bean></font></i></div></div><div style="font-size:12.8px"><i><font size="1"><br></font></i></div><div style="font-size:12.8px"><i><font size="1"><br></font></i></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1"><span></span></font>
<hr>
<font face="Arial" size="1"><span></span></font><b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">James Gross</span></b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">
<span>| Enterprise Application and </span>CMS Developer</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'"> (Enterprise Web Services)<br>
</span>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">UNC Charlotte
<span>| </span>Information Technology Services</span></p>
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">9201 University City Blvd.
<span>| </span>Charlotte, NC 28223</span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">Phone: 704-687-0298
<span>| Office: Kennedy 301-C39</span></span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="mailto:jgross15@uncc.edu" target="_blank">jgross15@uncc.edu</a>
</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">|
</span><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="http://www.uncc.edu" target="_blank">http://www.uncc.edu</a></span></p>
<span style="color:black;font-family:'Arial','sans-serif'"></span></font>
<hr>
<font face="Arial" size="1"><span style="color:black;font-family:'Arial','sans-serif'">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">If
you are not the intended recipient of this transmission or a person
responsible for delivering it to the intended recipient, any disclosure,
copying, distribution, or other use of any of the information in this
transmission is strictly prohibited. If you have received this
transmission in error, please notify me immediately by reply e-mail or
by telephone at 704-687-0298. Thank you.</span></p>
</span></font>
<p> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Apr 6, 2016 at 7:22 PM, Powell, Alan <span dir="ltr"><<a href="mailto:powela@rpi.edu" target="_blank">powela@rpi.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">> We have had Blackboard Transact functioning with the Shibboleth IdP V3<br>
>for a while now. Hope this helps.<br>
>To elaborate on the response by Michael:<br>
>Relying Party Overrides:<br>
<br>
>The metadata they provided contains information on 3 different Service<br>
>Providers. It was necessary to create relying party overrides for each of<br>
>them. Note the need to add in the SAML2.AttributeQuery profile as well<br>
>due to their use of the follow-up query.<br>
><!-- Custom Blackboard Relying Party 1 --><br>
><bean parent="RelyingPartyByName" c:relyingPartyIds="<Your Custom<br>
>Blackboard EntityID 1"><br>
><property name="profileConfigurations"><br>
><list><br>
><bean parent="SAML2.SSO" p:encryptAssertions="false"<br>
>p:encryptAttributes="false" p:encryptNameIDs="false"<br>
>p:signResponses="false" p:signAssertions="false" /><br>
><bean parent="SAML2.AttributeQuery" /><br>
></list><br>
></property><br>
></bean><br>
<br>
<br>
>Custom Attributes:<br>
>Their system does not use standard attributes. They have custom attribute<br>
>names that must match (bb_email, bb_givenName, bb_middleName,<br>
>bb_lastName, bb_userName, bb_customerCardNumber, bb_customerNumber).<br>
>New attribute resolver definitions were needed to provide these for<br>
>release to all three of their service providers, for example:<br>
<br>
<br>
>Restrict Default Attribute Release:<br>
<br>
>It was necessary to exclude their service providers from the release of<br>
>default attributes that have been configured to be released to any<br>
>registered SP. Their system could not handle the extra data.<br>
<br>
________________________________________<br>
>James Gross | Enterprise Application and CMS Developer (Enterprise Web<br>
>Services)<br>
<br>
<br>
<br>
<br>
I still have been unable to get transact to work with IDP 3.x. There have<br>
been a couple of threads on the transact list from people in a similar<br>
situation. The BB rep says they have a new document in ³QA² which will<br>
elicit what the correct configuration is, and I see James had gotten it to<br>
work, but I am following his and others points and it still doesn¹t work.<br>
He did give me the idea of overrides for every entityid in their metadata,<br>
as opposed to just the ones I see in the logs, but that didn¹t help (I<br>
assume by ³information on 3 different Service Providers² he means the<br>
entityids in the metadata)<br>
<br>
1. I am aware of they use of friendly names and I am using the same<br>
configuration from IDP v2. The OIDs they use in their "how to" document<br>
are incorrect but they seem to ignore them and use the friendly names. I<br>
am assuming a working configuration for what to release from v2 will work<br>
in v3. I am also releasing a transientid like they want.<br>
<br>
2. I have relying party overrides for all of their entityids and I appear<br>
to have the correct configuration as I see changes in DEBUG statements if<br>
I turn on encryption etc. The overrides I settled on are the same as James<br>
elicits.<br>
<br>
3. I don¹t have any default attributes released except for a transientId<br>
(via releaseTransientIdToAnyone). This worked fine in v2 so I don¹t see<br>
why this is a problem (I did go ahead and try and not automatically<br>
release it to their entityids and release it specifically but doesn¹t<br>
appear to make a difference).<br>
<br>
4. I am using a test server with a different entityid than my production<br>
one but transact does not appear to care. I have routinely switched back<br>
and forth between the production v2 server and a test v2 server with no<br>
problem (as long as you tell it the correct endpoints in their<br>
administrative interface).<br>
<br>
The logs suggest that the call comes in for attribute release and then a<br>
subsequent SOAP attribute query comes in, just like I see with my<br>
production server. I appear to be releasing the same things I do to the<br>
SOAP call with v3 that I did with v2. The only possible difference I see<br>
is that the assertion appears to be being encrypted with the SOAP<br>
response. I tried SHA1 but that didn¹t appear to make a difference<br>
<span class="HOEnZb"><font color="#888888"><br>
Alan<br>
<br>
<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>