<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I forget exactly where in the Google Apps Admin pages we found a
link to the metadata file, but this is what ours looks like.<br>
<br>
<EntityDescriptor entityID="google.com"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br>
<SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat><br>
<AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>
Location=<a class="moz-txt-link-rfc2396E" href="https://www.google.com/a/gustavus.edu/acs"><font color="red"><b>MailScanner has detected a possible fraud attempt from "www.google.com" claiming to be</b></font> "https://www.google.com/a/gustavus.edu/acs"</a>
/><br>
</SPSSODescriptor><br>
</EntityDescriptor><br>
<br>
<br>
Thanks,<br>
Dan Oachs<br>
Gustavus Adolphus College<br>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 04/13/2016 08:45 AM, Dave Perry
wrote:<br>
</div>
<blockquote
cite="mid:33299E3AD0404D4399856B9C1A828CF20141453A99@QGEXDB1.HCUK.local"
type="cite">
<meta http-equiv="Context-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<div class="WordSection1">
<p class="MsoNormal"><span>Thanks Dan. What was your metadata
file? Scott’s reply suggests their one is overly complicated
with things that may as well not be there.</span></p>
<p class="MsoNormal"><span> </span></p>
<p class="MsoNormal"><span> </span></p>
<p class="MsoNormal"><span>Dave</span></p>
<p class="MsoNormal"><span> </span></p>
<div>
<p class="MsoNormal"><span>_________________________________________________</span></p>
<p class="MsoNormal"><span>Dave Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930</span></p>
<p class="MsoNormal"><span> </span></p>
<p class="MsoNormal"><b><span>* Need a fast reply? Try
<a moz-do-not-send="true"
href="mailto:elearning@hull-college.ac.uk"><span>elearning@hull-college.ac.uk</span></a>
*</span></b></p>
</div>
<p class="MsoNormal"><span> </span></p>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span
lang="EN-US"> users
[<a class="moz-txt-link-freetext" href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>] <b>On Behalf Of </b>Dan
Oachs<br>
<b>Sent:</b> 13 April 2016 14:07<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Subject:</b> {Disarmed} Re: Google Apps + v3 Idp
(again)</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal">
We recently got idp 3 working for our Google Apps accounts.
Here is what I know:<br>
<br>
Added this to relying-party.xml in the
shibboleth.RelyingPartyOverrides section.<br>
<br>
<bean parent="RelyingPartyByName"
c:relyingPartyIds="google.com"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"
p:encryptAssertions="false" /><br>
</list><br>
</property><br>
</bean><br>
<br>
<br>
Added this to metadata-providers.xml<br>
<br>
<MetadataProvider id="GoogleMD" <br>
xsi:type="FilesystemMetadataProvider" <br>
xmlns="urn:mace:shibboleth:2.0:metadata"<br>
metadataFile="%{idp.home}/metadata/google-metadata.xml"/><br>
<br>
Added this to the saml-nameid.xml file in the
shibboleth.SAML2NameIDGenerators section<br>
<br>
<bean
parent="shibboleth.SAML2AttributeSourcedGenerator"<br>
p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"<br>
p:attributeSourceIds="#{ {'principal','uid'} }"
/><br>
<br>
Hopefully I remembered all the steps but I may have missed
something. Hope that helps anyway.<br>
<br>
Thanks,<br>
Dan Oachs<br>
Gustavus Adolphus College<br>
<br>
<br>
</p>
<div>
<p class="MsoNormal">On 04/13/2016 05:22 AM, Dave Perry wrote:</p>
</div>
<blockquote>
<div>
<p class="MsoNormal">
I am utterly confused (nothing new there, but I’ll attempt
to explain this one).</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
I have a relying-party entry which I believe others have
used:</p>
<p class="MsoNormal">
<bean
parent="RelyingPartyByName"
c:relyingPartyIds="google.com"></p>
<p class="MsoNormal">
<property name="profileConfigurations"></p>
<p class="MsoNormal">
<list></p>
<p class="MsoNormal">
<bean parent="SAML2.SSO"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
p:encryptAssertions="false" /></p>
<p class="MsoNormal">
</list></p>
<p class="MsoNormal">
</property></p>
<p class="MsoNormal">
</bean></p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
I have a request from google in my log which asks for
NameID as unspecified:</p>
<p class="MsoNormal">
<samlp:AuthnRequest</p>
<p class="MsoNormal">
AssertionConsumerServiceURL=<a moz-do-not-send="true"
href="https://www.google.com/a/hull-college.ac.uk/acs"><font color="red"><b>MailScanner has detected a possible fraud attempt from "www.google.com" claiming to be</b></font> "https://www.google.com/a/hull-college.ac.uk/acs"</a></p>
<p class="MsoNormal">
ID="achibhchkpnnlacecgddfgbpfdallakncgfgofab"
IsPassive="false"</p>
<p class="MsoNormal">
IssueInstant="2016-04-13T09:39:51Z"</p>
<p class="MsoNormal">
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</p>
<p class="MsoNormal">
ProviderName="google.com" Version="2.0"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"></p>
<p class="MsoNormal">
<saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">google.com</saml:Issuer></p>
<p class="MsoNormal">
<samlp:NameIDPolicy AllowCreate="true"
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/></p>
<p class="MsoNormal">
</samlp:AuthnRequest></p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
And google’s own metadata download (taken from the GA
admin control panel) which has a weird entityID of
<a moz-do-not-send="true"
href="https://accounts.google.com/o/saml2?idpid=C04au2c47">https://accounts.google.com/o/saml2?idpid=C04au2c47</a></p>
<p class="MsoNormal">
Which specifies emailAddress as the NameID policy
(somewhat contradictory to the request the IdP gets):</p>
<p class="MsoNormal">
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat></p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
My error log says there is no entry to handle entityID
google.com in relying-party:</p>
<p class="MsoNormal">
2016-04-13 10:39:52,256 - DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334]
- Metadata backing store does not contain any
EntityDescriptors with the ID: google.com</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
Even editing the metadata file they provide, to the
following first line:</p>
<p class="MsoNormal">
<md:EntityDescriptor
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="google.com"
validUntil="2021-04-12T08:53:16.000Z"></p>
<p class="MsoNormal">
Doesn’t work.</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
Any suggestions appreciated.</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
Thanks,</p>
<p class="MsoNormal">
Dav</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
_________________________________________________</p>
<p class="MsoNormal">
Dave Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal">
<b>* Need a fast reply? Try <a moz-do-not-send="true"
href="mailto:elearning@hull-college.ac.uk">elearning@hull-college.ac.uk</a>
*</b></p>
<p class="MsoNormal">
</p>
</div>
<div>
<p class="MsoNormal"><a moz-do-not-send="true"
href="http://www.hull-college.ac.uk/about-us/stakeholders-newsletter">The
Review Newsletter</a><span>�</span></p>
</div>
<div>
<p class="MsoNormal"><br>
This message is sent in confidence for the addressee<span>�</span>
only.
<span>�</span>It may contain confidential or sensitive<span>�</span>
information.
<span>�</span>The contents are not to be disclosed<span>�</span>
to anyone other than the addressee.
<span>�</span>Unauthorised<span>�</span> recipients are
requested to preserve this<span>�</span> confidentiality
and to advise us of any errors in<span>�</span>
transmission.
<span>�</span>Any views expressed in this message<span>�</span>
are solely the views of the individual and do not<span>�</span>
represent the views of the College. <span>�</span>Nothing
in this<span>�</span> message should be construed as
creating a contract.
</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Hull College Group owns the email
infrastructure, including the contents.
</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Hull College Group is committed to
sustainability, please reflect before printing this email.
</p>
</div>
<div>
<div class="MsoNormal">
<hr width="100%">
</div>
</div>
<p class="MsoNormal"><br>
<br>
</p>
</blockquote>
<p class="MsoNormal"> </p>
</div>
<div> <span><a moz-do-not-send="true"
href="http://www.hull-college.ac.uk/about-us/stakeholders-newsletter">The
Review Newsletter</a></span> </div>
<div><br>
This message is sent in confidence for the addressee <span>only.
It may contain confidential or sensitive </span> <span>information.
The contents are not to be disclosed </span> <span>to anyone
other than the addressee. Unauthorised </span> <span>recipients
are requested to preserve this </span> <span>confidentiality
and to advise us of any errors in </span> <span>transmission.
Any views expressed in this message </span> <span>are solely
the views of the individual and do not </span> <span>represent
the views of the College. Nothing in this </span> <span>message
should be construed as creating a contract.</span> </div>
<div> <br>
</div>
<div> Hull College Group owns the email infrastructure, including
the contents. </div>
<div> <br>
</div>
<div> Hull College Group is committed to sustainability, please
reflect before printing this email. </div>
<div>
<hr> </div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>