<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:11pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Google doesn't actually care what you call the NameID format, they just care that the value contained in the NameID is correct. Here's the approach you'll want to take. Note that this process assume you've checked the "use domain specific issuer" box in
the Google Admin Panel to get an SP entityID that is custom to your tenant.</p>
<p><br>
</p>
<p>1. Wire up an appropriate well-named custom NameID format in saml-nameid.xml. See the Shibboleth documentation on how to do this here [1]<br>
2. Create metadata for your GSuite tenant. Specify your NameID format explicitly in it with a <span><NameIDFormat></NameIDFormat> child element under <<span>SPSSODescriptor> like so:<br>
</span></span><span><br>
</p>
<div><EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="google.com/a/<span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:14.6667px">your.tenant.domain</span>"></div>
<div> <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div>
<div> <NameIDFormat>your-well-named-format-here</NameIDFormat></div>
<div> <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</div>
<div> Location="https://www.google.com/a/<span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:14.6667px">your.tenant.domain</span>/acs"
/></div>
<div> <AttributeConsumingService index="1"></div>
<div> <ServiceName xml:lang="en">Your GSuite Tenant Name for UI Display</ServiceName></div>
<div> </AttributeConsumingService></div>
<div> </SPSSODescriptor></div>
<div></EntityDescriptor></div>
<br>
</span>3. Edit attribute-filter.xml to ensure that you are releasing the source attribute for this NameID format to your GSuite tenant's entityID<br>
4. Add a relying-party.xml entry for your GSuite tenant. Since you'll have specified the NameID format in the metadata you generate, the "nameIDFormatPrecedence" line isn't strictly necessary, but I included it for consistency with our approach with other SPs:<br>
<p></p>
<div><br>
<div><!-- Google Apps does not support encrypted assertions, and strictly expects there to not be an</div>
<div> attribute statment included in the assertion. It also requires a custom NameID format that matches</div>
<div><span style="font-size:11pt"> the synchronized username. --></span></div>
<div><bean parent="RelyingPartyByName" c:relyingPartyIds="google.com/a/your.tenant.domain"></div>
<div><property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="SAML2.SSO"</div>
<div> p:encryptAssertions="false"</div>
<div> p:includeAttributeStatement="false"</div>
<div> p:nameIDFormatPrecedence="your-name-id-format-here" /></div>
<div> </list></div>
<div></property></div>
<div></bean></div>
<div><br>
</div>
</div>
<div><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:14.6667px">For what it's worth, the NameID value doesn't have to be email address,
it just has to match the username you have synchronized to GSuite. We're sending our HawkID (local name for NetID) as the NameID.</span><br>
</div>
<div><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:14.6667px"><br>
</span></div>
<div><span style="font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:14.6667px">If you haven't found this page already, Google's (thoroughly underspecified)
documentation on getting this set up can be found here [2]</span></div>
<div><br>
</div>
Best,
<div>Michael Domingues</div>
<div>Directory and Authentication Services, AIS, ITS</div>
<div>University of Iowa<br>
<br>
[1] <a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration" class="x_OWAAutoLink" id="LPlnk750516">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration</a></div>
<div>[2] <a href="https://support.google.com/a/answer/60224?hl=en&ref_topic=6348126" class="x_OWAAutoLink" id="LPlnk754324">https://support.google.com/a/answer/60224?hl=en&ref_topic=6348126</a><br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration" class="x_OWAAutoLink"></a>
<p></p>
<br>
<p></p>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ernie Kinsey <Ernie.Kinsey@cpcc.edu><br>
<b>Sent:</b> Thursday, August 17, 2017 6:59:38 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Question about G Suite authentication via Shibboleth.</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">I'm having problems getting G Suite to work properly with Shibboleth. What seems to be happening is that the "nameid-format" of the "NameID" attribute is beind delivered as "transient", as in:<br>
<br>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="<a href="https://idp-test.cpcc.edu/idp/shibboleth">https://idp-test.cpcc.edu/idp/shibboleth</a>" SPNameQualifier="google.com">AAdzZWNyZXQx95Th/b1Mlxm2jEP4c7FNo19z0EBTZWm38vkumXm1Mlrtj4UqsdHMotpDVLbwU/yf2qg+Bz1BNT0Z2x87/+eg2uf8DA76XTEZkr7GfBcrqEGa</saml2:NameID><br>
<br>
Based on the Google documentation, it's supposed to be "email" (for SAML 1.1) or "emailAddress" (for SAML 2.0).<br>
<br>
I've mucked around in the assorted configuration files in the /conf folder, but I can't seem to force this attribute to be anything other than "transient". To compound the problem, since the attribute IS "transient", the value I can see in the SAML message
is "obscured" and I have no idea what value is actually being sent to G Suite - and the G Suite logging is inadequate to see what it thinks it's getting.<br>
<br>
Any help would be appreciated. For what it’s worth, I’ve done some due diligence by looking through the other items posted here that seem relevant to this problem, but am still stumped.<br>
<br>
Thanks,<br>
Ernest K. Kinsey, Jr.<br>
Information Technology and Research Services<br>
Central Piedmont Community College<br>
Charlotte, NC 28255<br>
<br>
<br>
<br>
________________________________<br>
<br>
This e-mail, including any attachments, is intended only for the addressee's use and may contain confidential and proprietary information. If you are not the intended recipient, you are hereby notified that any retention, dissemination, reproduction, or use
of the information contained in this e-mail is strictly prohibited. If you have received this e-mail by error, please delete it and immediately notify the sender. Thank you for your cooperation.<br>
-- <br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</div>
</span></font>
</body>
</html>