<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>If I recall correctly, Bb Transact is unusual in making two requests to the IdP. It ignores attributes in the IDP's authN response except to pull a (transient) ID, which is then used to make an attribute query which you have to explicitly support.<br><br><div>David.Bantz<span class="Apple-style-span" style="-webkit-composition-fill-color: rgba(175, 192, 227, 0.231373); -webkit-composition-frame-color: rgba(77, 128, 180, 0.231373); ">@<a href="http://alaska.edu">Alaska.edu</a></span><div><span class="Apple-style-span" style="-webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);"><br></span></div></div></div><div><br>On May 24, 2016, at 06:36, James McCartin <<a href="mailto:jmccartin@loyola.edu">jmccartin@loyola.edu</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.SP4135185, li.SP4135185, div.SP4135185
{mso-style-name:"SP\.4\.135185";
mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
text-autospace:none;
font-size:12.0pt;
font-family:"Arial",sans-serif;}
span.SC42549
{mso-style-name:"SC\.4\.2549";
mso-style-priority:99;
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">I’ve setup a IdP v3 server. It works with all of my SPs except Blackboard Transact.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On my IdP v2 server, the log shows the following when logging in to Bb Transact:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">20160518T091808Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_281E36148A90137BEB2F951454AAFD5E|<a href="https://sp.transactsp.com/shibboleth-sp/eacct-loyola-sp.blackboard.com/eaccounts|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_37e97a02028ff0c58ccf9d21c2415708|nsbabirye|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|eduPersonPrincipalName,eduPersonAffiliation,surname,eduPersonScopedAffiliation,loyolaID,givenName,memberOf,commonName,loyCampusHousing,BblastName,transientId,BbgivenName,eduPersonTargetedID,BbuserName,email,Bbemail,displayName,|_50a2bc08a2dc76a9e945e2684aa880e3||">https://sp.transactsp.com/shibboleth-sp/eacct-loyola-sp.blackboard.com/eaccounts|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_37e97a02028ff0c58ccf9d21c2415708|nsbabirye|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|eduPersonPrincipalName,eduPersonAffiliation,surname,eduPersonScopedAffiliation,loyolaID,givenName,memberOf,commonName,loyCampusHousing,BblastName,transientId,BbgivenName,eduPersonTargetedID,BbuserName,email,Bbemail,displayName,|_50a2bc08a2dc76a9e945e2684aa880e3||</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">20160518T091809Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_139A6FB6324A1B8F6EB0044E5FFCD7B1|<a href="https://sp.transactsp.com/shibboleth-sp/eacct-loyola-sp.blackboard.com/eaccounts|urn:mace:shibboleth:2.0:profiles:saml2:query:attribute|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_ad00eddc06406f88fc4b2063ee36cae1|nsbabirye|">https://sp.transactsp.com/shibboleth-sp/eacct-loyola-sp.blackboard.com/eaccounts|urn:mace:shibboleth:2.0:profiles:saml2:query:attribute|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_ad00eddc06406f88fc4b2063ee36cae1|nsbabirye|</a>|eduPersonPrincipalName,eduPersonAffiliation,surname,eduPersonScopedAffiliation,loyolaID,givenName,memberOf,commonName,loyCampusHousing,BblastName,transientId,BbgivenName,eduPersonTargetedID,BbuserName,email,Bbemail,displayName,|_50a2bc08a2dc76a9e945e2684aa880e3|_21f765d7e371d879a7a341218ad19816,|<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On my IdP v3 server, the log shows the following when logging in to Bb Transact:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">20160519T094437Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_A7CEDB9D1C609C863316C7A5D2E53A3B|<a href="https://sp.transactsp.com/shibboleth-sp/eacct-loyola-sp.blackboard.com/eaccounts|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_eb749e6e4984aaebd70b94400b5340bb|jmccartin|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|BblastName,commonName,telephoneNumber,Bbemail,eduPersonAffiliation,displayName,givenName,BbuserName,BbgivenName,title,eduPersonScopedAffiliation,loyCampusHousing,surname,eduPersonPrincipalName,email|AAdzZWNyZXQxGfgGRtIpzGacHGAKrI0Fwk8ZmTQgFviVuOzTpV+gGBdhSzb0i67h3BFoFaQsn6nbcDUdhqx/7QbykjV/0tqOcHp1CFdPtQ1fOKsCllNHlsliSYqhf5/k4Ulcz0r8DuWS7rBJ98SH5iZD0hbnjYHTsEWnYiO5UP3FpD/qyxtRtH+HLCOTBe2tojbzQ0I=|_5ad865cc85a89cb0953ee16b63fddf03|">https://sp.transactsp.com/shibboleth-sp/eacct-loyola-sp.blackboard.com/eaccounts|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibprodapp.loyola.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_eb749e6e4984aaebd70b94400b5340bb|jmccartin|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|BblastName,commonName,telephoneNumber,Bbemail,eduPersonAffiliation,displayName,givenName,BbuserName,BbgivenName,title,eduPersonScopedAffiliation,loyCampusHousing,surname,eduPersonPrincipalName,email|AAdzZWNyZXQxGfgGRtIpzGacHGAKrI0Fwk8ZmTQgFviVuOzTpV+gGBdhSzb0i67h3BFoFaQsn6nbcDUdhqx/7QbykjV/0tqOcHp1CFdPtQ1fOKsCllNHlsliSYqhf5/k4Ulcz0r8DuWS7rBJ98SH5iZD0hbnjYHTsEWnYiO5UP3FpD/qyxtRtH+HLCOTBe2tojbzQ0I=|_5ad865cc85a89cb0953ee16b63fddf03|</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The SOAP call is not there. What would prevent the soap call from being made?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Bb Transact supports IdP v3 with the following configuration (which I made):<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="SP4135185"><span class="SC42549"><span style="font-size:10.0pt"><util:list id="shibboleth.RelyingPartyOverrides">
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185"><span class="SC42549"><o:p> </o:p></span></p>
<p class="SP4135185"><span class="SC42549"><span style="font-size:10.0pt"><!-- </span>
</span><o:p></o:p></p>
<p class="SP4135185"><span class="SC42549"><span style="font-size:10.0pt">Override example that identifies a single RP by name and configures it
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185"><span class="SC42549"><span style="font-size:10.0pt">for SAML 2 SSO without encryption. This is a common "vendor" scenario.
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185"><span class="SC42549"><span style="font-size:10.0pt">--> </span>
</span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185"><span class="SC42549"><o:p> </o:p></span></p>
<p class="SP4135185" style="margin-left:.5in"><span class="SC42549"><span style="font-size:10.0pt"><bean parent="RelyingPartyByName" c:relyingPartyIds="[entitiyIds]">
</span></span><o:p></o:p></p>
<p class="SP4135185" style="margin-left:1.0in"><span class="SC42549"><span style="font-size:10.0pt"><property name="profileConfigurations">
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185" style="margin-left:1.5in"><span class="SC42549"><span style="font-size:10.0pt"><list>
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185" style="margin-left:2.0in"><span class="SC42549"><span style="font-size:10.0pt"><bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" />
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185" style="margin-left:2.0in"><span class="SC42549"><span style="font-size:10.0pt"><bean parent="SAML2.SSO" p:signResponses="never" p:encryptAssertions="false" p:postAuthenticationFlows="attribute-release" />
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185" style="margin-left:2.0in"><span class="SC42549"><span style="font-size:10.0pt"><bean parent="SAML2.AttributeQuery" p:encryptAssertions="false" />
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185" style="margin-left:1.5in"><span class="SC42549"><span style="font-size:10.0pt"></list>
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185" style="margin-left:1.0in"><span class="SC42549"><span style="font-size:10.0pt"></property>
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="SP4135185" style="margin-left:.5in"><span class="SC42549"><span style="font-size:10.0pt"></bean>
</span></span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span class="SC42549"><o:p> </o:p></span></p>
<p class="MsoNormal"><span class="SC42549"><span style="font-size:10.0pt"></util:list></span></span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">James<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:gray">James McCartin<br>
</span></b><span style="font-size:10.0pt;color:gray">Senior Systems Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:gray">Infrastructure – Technology Services
<br>
<image001.gif><br>
Loyola University Maryland<br>
4501 North Charles Street<br>
Baltimore, MD 21210<br>
<br>
410-617-2605<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:gray"><a href="mailto:jmccartin@loyola.edu"><span style="color:blue">jmccartin@loyola.edu</span></a><u><br>
</u><br>
<a href="http://www.loyola.edu/"><span style="color:blue">www.loyola.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:gray"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="http://www.facebook.com/LoyolaMaryland"><span style="font-size:10.0pt;color:blue;text-decoration:none"><image002.gif></span></a><a href="http://www.twitter.com/LoyolaMaryland"><span style="font-size:10.0pt;color:blue;text-decoration:none"><image003.gif></span></a><a href="http://www.youtube.com/LoyolaMaryland"><span style="color:#1F497D;text-decoration:none"><image004.gif></span></a><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">--<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;color:red">Security Alert: Loyola Technology Services will never ask for your password. Please do not share it with others.<o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div></blockquote><blockquote type="cite"><div><span>-- </span><br><span>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></span></div></blockquote></body></html>