<div dir="ltr">Hi Stephen,<div><br></div><div>This is what I have in my metadata-providers file -</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><!-- Hathitrust - get from InCommon --></div></div><div><div><br></div></div><div><div><MetadataProvider id="hathitrust" </div></div><div><div>xsi:type="FileBackedHTTPMetadataProvider" </div></div><div><div>metadataURL="<a href="http://md.incommon.org/InCommon/InCommon-metadata.xml">http://md.incommon.org/InCommon/InCommon-metadata.xml</a>" </div></div><div><div>backingFile="/opt/shibboleth-idp/metadata/InCommon-metadata.xml"/> </div></div></blockquote><div><br></div><div>I called mine 'hathitrust' but of course you could could use id="incommon" or anything else. </div><div><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>FYI: You can use that id to reload metadata just for one SP, using the reload-metadata command in the <b>bin</b> directory:</div><div><br></div><div> ./reload-metadata.sh -id hathitrust</div><div><br></div><div>Metadata files reload periodically by themselves, but if you're working with an SP and they've made a change to their metadata file, you can force a reload this way.</div></blockquote><div><br></div><div>The other step is that you have to decide which attributes you want to release to the SP. Hathitrust has special things it wants. One thing they recommend (I think recommend?) is eduPersonTargetID, which lets folks save their searches and so on without exposing their actual userid or whatever. This is done by creating a computerID, generated using a sourceattribute and a salt. This stuff happens in the attribute-resolver file:</div><div><br></div><div><div>First, you set up the mechanism that generates the ID. This will go at the bottom of the <b>attribute-resolver.xml</b> file, in the same area where you have your LDAP or whatever defined:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div> <!-- Computed targeted ID connector --></div><div> <resolver:DataConnector xsi:type="dc:ComputedId"</div><div> id="computedID"</div><div> generatedAttributeID="computedID"</div><div> sourceAttributeID="workforceID"</div><div> salt="Your weird phrase here"></div><div> <resolver:Dependency ref="YourLDAP" /></div><div> </resolver:DataConnector> </div><div></resolver:AttributeResolver></div></blockquote><div><br></div><div>(I used "workforceID" as my source attribute because it's static for people. You can use whatever makes sense for you.) Even if you move to a new IdP installation, this value, once created, will always be the same for your users, as long as you use the same salt and source attribute.</div><div><br></div><div>Next, still in the attribute-resolver.xml file, you configure the eduPersonTargetedID attribute to get its value from the ComputedId you set up:</div><div><br></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><div> <resolver:AttributeDefinition xsi:type="ad:SAML2NameID" id="eduPersonTargetedID" </div></div></div><div><div><div> nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" <b>sourceAttributeID="computedID</b>"></div></div></div><div><div><div> <resolver:Dependency ref="computedID" /></div></div></div><div><div><div> <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /></div></div></div><div><div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" /></div></div></div><div><div><div> </resolver:AttributeDefinition></div></div></div></blockquote><div><div><br></div></div><div><br></div><div>Lastly, you edit your <b>attribute-filter.xml</b> file to release the attributes to Hathitrust. This is what I have:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><!-- Attributes released to Hathitrust --></div></div><div><div><br></div></div><div><div><afp:AttributeFilterPolicy id="hathitrust" ></div></div><div><div> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="http://www.hathitrust.org/shibboleth-sp">http://www.hathitrust.org/shibboleth-sp</a>"/></div></div><div><div><afp:AttributeRule attributeID="transientId"></div></div><div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div></div><div><div> </afp:AttributeRule></div></div><div><div> <afp:AttributeRule attributeID="eduPersonPrincipalName"></div></div><div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div></div><div><div> </afp:AttributeRule></div></div><div><div> <afp:AttributeRule attributeID="eduPersonScopedAffiliation"></div></div><div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div></div><div><div> </afp:AttributeRule></div></div><div><div> <afp:AttributeRule attributeID="displayName"></div></div><div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div></div><div><div> </afp:AttributeRule></div></div><div><div><afp:AttributeRule attributeID="eduPersonTargetedID"></div></div><div><div> <afp:PermitValueRule xsi:type="basic:ANY" /></div></div><div><div> </afp:AttributeRule></div></div><div><div></afp:AttributeFilterPolicy></div></div></blockquote><div><br></div><div>(The eduPersonTargetID is listed at the end.) </div><div><br></div><div>Well, I hope this helps and wasn't TMI.</div><div><br></div><div>Karla</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Feb 1, 2017 at 11:29 AM, Klein, Stephen <span dir="ltr"><<a href="mailto:SKlein@gc.cuny.edu" target="_blank">SKlein@gc.cuny.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_1808608438106799301WordSection1">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We are in the processing of installing Shibboleth as an Identity Provider and I do not understand the following in the in the Post Installation tasks:<u></u><u></u></p>
<p class="MsoNormal">‘Complete Metadata configuration by providing the metadata for the SPs you will interoperate with in the metadata-providers.xml’<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:#1f497d"><a href="https://wiki.shibboleth.net/confluence/display/IDP30/Installation" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/IDP30/<wbr>Installation</a><u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">We are setting up Shibboleth, again as an Identity Provider, for HatthiTrust authentication, so not sure how to approach this task. Can someone send me a sample?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I also see:<u></u><u></u></p>
<p class="MsoNormal">‘load SAML metadata for the service provider with which you will interact’
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I assume that these two are referencing the same required info?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thank you.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Sincerely,<u></u><u></u></p>
<p class="MsoNormal">Stephen<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Stephen Klein<u></u><u></u></p>
<p class="MsoNormal"><a href="http://libguides.gc.cuny.edu/prf.php?account_id=522" target="_blank"><span style="color:blue">http://libguides.gc.cuny.edu/<wbr>prf.php?account_id=522</span></a><u></u><u></u></p>
<p class="MsoNormal">Digital Services Librarian<u></u><u></u></p>
<p class="MsoNormal">Room 2318<u></u><u></u></p>
<p class="MsoNormal">Graduate Center Library<u></u><u></u></p>
<p class="MsoNormal">365 5th Avenue<u></u><u></u></p>
<p class="MsoNormal">New York, NY 10016-4309<u></u><u></u></p>
<p class="MsoNormal"><a href="tel:(212)%20817-7074" value="+12128177074" target="_blank">212 817 7074</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div style="margin-left:40px">Karla Borecky<br>Systems Administrator<br>ITS<br>Smith College<br>Northampton, MA 01063<br></div></div>
</div>