<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">No, Transact did not require EPPN in the Subject, it worked fine, at least with IdPv2, with Transient or CryptoTransient as the NameId. Some things about Transact that have been sent to this list before:<div class=""><br class=""></div><div class=""> - has no allowance/capability for checking the front-channel signature, which is why it "ignores" any and all attributes sent that way,</div><div class=""> - only cares about the FriendlyName for attributes, ignores the actual name,</div><div class=""> - always does the back-channel attribute query, because that's the only way it has "security" around the attributes it receives</div><div class=""><br class=""></div><div class="">I got a site working with v2 using Scott's added CryptoTransient support for v2. But it was trial and error, as one gets no feedback from the other side. Most frustrating integration I can recall. </div><div class=""><br class=""></div><div class="">Presumably it works with v3 with the default Transient which is essentially equivalent to the crypto-transient for v2.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On May 24, 2016, at 12:28 PM, IAM David Bantz <<a href="mailto:dabantz@alaska.edu" class="">dabantz@alaska.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Here's my working v2 relying party config for Transact:<div class=""><pre class="" style="border: 1px solid rgb(215, 215, 215); margin: 1em 1.75em; padding: 0.25em; overflow: auto; font-size: 13px; background-color: rgb(247, 247, 247); background-position: initial initial; background-repeat: initial initial;"><!-- BlackBoard Transact does not support encryption; uses AttributeQuery 2014-10-23 -->
<RelyingParty id="<a href="https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt" class="">https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt</a>"
provider="urn:mace:incommon:<a href="http://alaska.edu/" class="">alaska.edu</a>"
defaultSigningCredentialRef="IdPCredential"
defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
<ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
<ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" encryptAssertions="never" encryptNameIds="never" />
</RelyingParty></pre></div><div class="gmail_extra">Additional unique aspects of the Transact SP are:</div><div class="gmail_extra"><pre class="" style="border: 1px solid rgb(215, 215, 215); margin: 1em 1.75em; padding: 0.25em; overflow: auto; font-size: 13px; background-color: rgb(247, 247, 247); background-position: initial initial; background-repeat: initial initial;"><!-- Bb Transact require something like ePPN in the SAML Subject --></pre></div><div class="gmail_extra"><pre class="" style="border: 1px solid rgb(215, 215, 215); margin: 1em 1.75em; padding: 0.25em; overflow: auto; font-size: 13px; background-color: rgb(247, 247, 247); background-position: initial initial; background-repeat: initial initial;"><!-- Bb Transact requires its own unique FriendlyNames so add definitions and encoders with those FriendlyNames --></pre><div class="gmail_quote">David Bantz</div><div class="gmail_quote">UAlaska</div><div class="gmail_quote"><br class=""></div><div class="gmail_quote">On Tue, May 24, 2016 at 8:24 AM, Peter Schober <span dir="ltr" class=""><<a href="mailto:peter.schober@univie.ac.at" target="_blank" class="">peter.schober@univie.ac.at</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">* James McCartin <<a href="mailto:jmccartin@loyola.edu" class="">jmccartin@loyola.edu</a>> [2016-05-24 17:56]:<br class="">
<span class="">> The SP does ignore the attributes sent in the HTTP POST and then<br class="">
> queries the IdP. What can I look at to confirm that my v3 IdP<br class="">
> supports this type of attribute query?<br class="">
<br class="">
</span>The documentation? I have no idea how you deployed your IDP, how you<br class="">
decided supported SOAP queries, on what port, involving what<br class="">
containers, etc.<br class="">
<br class="">
Assuming for now you have properly configured SOAP support, I'd start<br class="">
with making sure the port you publish for your IDP's<br class="">
AttributeAuthority endpoints is open on the firewall.<br class="">
I.e., if <a href="https://shibprodapp.loyola.edu/idp/shibboleth" rel="noreferrer" target="_blank" class="">https://shibprodapp.loyola.edu/idp/shibboleth</a> is your IDP<br class="">
make sure that <a href="https://shibprodapp.loyola.edu:8443/" rel="noreferrer" target="_blank" class="">https://shibprodapp.loyola.edu:8443/</a> can be reached<br class="">
from the outside world -- it currently isn't.<br class="">
<br class="">
If in doubt look at the SAML Metadata the SP in question has about<br class="">
your IDP, and make sure the endpoints puiblished there are reachable.<br class="">
<div class=""><div class="h5">-peter<br class="">
--<br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class="">
</div></div></blockquote></div><br class=""></div></div>
-- <br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""><div class="">
<br class="">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.
</div>
<br class=""></div></body></html>