<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:Calibri;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">We are testing box as an InCommon member. I can’t get authentication to work even though it appears I am doing the right thing. My preference is to make sure it works with IDP
3.x. Can anyone who is using box provide any insight, ideally with IDP 3.x? Does anyone see anything wrong with what I am doing?</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">The examples I’ve encountered seem to just indicate you do the typical Shib thing of releasing attributes but don’t you need to have the email be in the SAML subject in addition?
(ie xsi:type="enc:SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">)</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">I have the following attribute defined (in addition to sn and giveName which are not shown). </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mailLocalAddress" ></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <resolver:Dependency ref="myLDAP" /></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
/></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:email"/></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"/></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">I release this attribute and sn and givenName to box. </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:AttributeFilterPolicy id="boxSP"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="https://services.box.com/sp"><span style="color:#0000E3">https://services.box.com/sp</span></a>"
/></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:AttributeRule attributeID="mail"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:PermitValueRule xsi:type="basic:ANY" /></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </afp:AttributeRule></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:AttributeRule attributeID="sn"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:PermitValueRule xsi:type="basic:ANY" /></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </afp:AttributeRule></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:AttributeRule attributeID="givenName"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <afp:PermitValueRule xsi:type="basic:ANY" /></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </afp:AttributeRule></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </afp:AttributeFilterPolicy></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">To get the correct nameid format, to use SHA1 which seemingly is the the only thing that works and to prevent encryption I do this:</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://services.box.com/sp%22"><span style="color:#0000E3">https://services.box.com/sp"</span></a>></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <property name="profileConfigurations"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <list></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="#{{ 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' }}" p:securityConfiguration-ref="SHA1SecurityConfig"
p:encryptAssertions="false" p:encryptAttributes="false" p:encryptNameIDs="false" p:signResponses="true" p:signAssertions="false" /></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </list></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </property></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </bean></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </util:list></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">I am using their metadata from the InCommon metadata (the metadata on their site still uses box.net, the metadata in InCommon shows <a href="https://services.box.com/sp"><span style="color:#0B4CB4">https://services.box.com/sp</span></a> as the
entityid)</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">I get a SAML AuthnRequest</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"><<?xml version="1.0" encoding="UTF-8"?></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"><samlp:AuthnRequest ID="LM9BcupF8DmThyhXYeiHWfg-kVo"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> IssueInstant="2016-06-07T20:10:22.364Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://services.box.com/sp%3C/saml:Issuer%3E"><span style="color:#0000E3">https://services.box.com/sp</saml:Issuer></span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <samlp:NameIDPolicy AllowCreate="true"/></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"></samlp:AuthnRequest></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier">I return a SAML assertion with an email in the subject and three attributes</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:Subject></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"><a href="mailto:powela@rpi.edu"><span style="color:#0000E3">powela@rpi.edu</span></a></saml2:NameID></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:SubjectConfirmationData Address="128.113.124.189"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> InResponseTo="LM9BcupF8DmThyhXYeiHWfg-kVo"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> NotOnOrAfter="2016-06-07T20:15:34.386Z"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> Recipient="<a href="https://sso.services.box.net/sp/ACS.saml2"><span style="color:#0000E3">https://sso.services.box.net/sp/ACS.saml2</span></a>"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> /></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </saml2:SubjectConfirmation></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </saml2:Subject></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:AttributeStatement></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:Attribute FriendlyName="mail"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> Name="urn:oid:0.9.2342.19200300.100.1.3"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> ></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance"><span style="color:#0000E3">http://www.w3.org/2001/XMLSchema-instance</span></a>"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> xsi:type="xsd:string"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> ><a href="mailto:powela@rpi.edu"><span style="color:#0000E3">powela@rpi.edu</span></a></saml2:AttributeValue></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </saml2:Attribute></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:Attribute FriendlyName="sn"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> Name="urn:oid:2.5.4.4"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> ></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance"><span style="color:#0000E3">http://www.w3.org/2001/XMLSchema-instance</span></a>"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> xsi:type="xsd:string"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> >Powell</saml2:AttributeValue></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </saml2:Attribute></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:Attribute FriendlyName="givenName"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> Name="urn:oid:2.5.4.42"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> ></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> <saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance"><span style="color:#0000E3">http://www.w3.org/2001/XMLSchema-instance</span></a>"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> xsi:type="xsd:string"</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> >Alan</saml2:AttributeValue></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </saml2:Attribute></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </saml2:AttributeStatement></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:Courier"> </span><o:p></o:p></p>
</div>
</body>
</html>