<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi,</p>
<p><br>
</p>
<p>The nameID release appears to be working as-is:</p>
<p>20180416T142441Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_bc64381f-c438-45bc-8a49-0cadd9cabca1|SAManage.com|<a class="moz-txt-link-freetext" href="http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp-test.ucs.ed.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f0b78cba8668e85dbfa56ac678a6cd1e|mcairney|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|samanagemail,transientId|Mark.Cairney@ed.ac.uk|_c03102f3f912aeb846a4c32bea59be6d">http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp-test.ucs.ed.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f0b78cba8668e85dbfa56ac678a6cd1e|mcairney|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|samanagemail,transientId|Mark.Cairney@ed.ac.uk|_c03102f3f912aeb846a4c32bea59be6d</a><br>
</p>
<p>The issue seems to be that they expect a certificate to be sent
during the transaction<br>
</p>
From the information I've received from the user:<br>
<br>
"<br>
Hello,<br>
This link would show what visible in your instance's metada:
<div id="cAAA_10M" class="a0 b1 c0 d0 e1 f8 h10 i0 j5 k1 l1"><wbr><a
href="https://edin.samanage.com/saml/metadata" class="a0 b1 c0
d0 e0 f8 h10 i11 j5 k2 l1" style="line-height:20px;">https://edin.samanage.com/saml/metadata</a>.
However, as mentioned previously we are <wbr>looking for the
token signing certificate to be included in the saml request as it
would be <wbr>compared with the certificate you have pasted under
Setup -> SSO for validity.<br>
"<br>
<br>
Does this make sense to you given they themselves don't provide
any certificates for signing/encryption (the metadata file they
provided is literally 4 lines of XML!) and the only certificates
I'm aware of that are routinely transferred during a SAML
conversation are one or more of these? Also at least one piece of
the few bits of documentation say to disable encryption and
signing?<br>
I was under the impression that signing/encryption had to be
mutually declared between both parties?<br>
<br>
</div>
<div class="moz-cite-prefix">On 16/04/18 17:01, Peter Schober wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20180416160102.tc2ntsmmtfjynp5a@aco.net">
<pre wrap="">* Mark Cairney <a class="moz-txt-link-rfc2396E" href="mailto:Mark.Cairney@ed.ac.uk"><Mark.Cairney@ed.ac.uk></a> [2018-04-16 15:47]:
</pre>
<blockquote type="cite">
<pre wrap="">The docs I've been following are:
<a class="moz-txt-link-freetext" href="https://community.samanage.com/message/6116">https://community.samanage.com/message/6116</a>
and
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/SAManage">https://wiki.shibboleth.net/confluence/display/SHIB2/SAManage</a>
</pre>
</blockquote>
<pre wrap="">
>From those two I gather that your question actually is:
How do I release the subject's email address as an emailAddress-format
NameID in Shibboleth IDPv3?
</pre>
<blockquote type="cite">
<pre wrap="">relying-party.xml:
<bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:encryptAssertions="never"
p:signAssertions="always" p:encryptNameIDs="never"
p:signResponses="always"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
</list>
</property>
</bean>
</pre>
</blockquote>
<pre wrap="">
FYI, you can drop p:nameIDFormatPrecedence from there and instead
simply add that format as the first (or only) NameIDFormat element to
the locally-managed SAML metadata you load from
%{idp.home}/metadata/samanage-metadata.xml
</pre>
<blockquote type="cite">
<pre wrap="">attribute-resolver.xml:
</pre>
</blockquote>
<pre wrap="">
No need to touch the resolver for IDPv3. Instead just add this to your
conf/saml-nameid.xml (and remove your previous attempts while you#re
there) to the util:list with id="shibboleth.SAML2NameIDGenerators":
<!-- email as NameID -->
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
p:omitQualifiers="true"
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
p:attributeSourceIds="#{ {'mail'} }" />
and release the 'mail' attribute to the SP in your
attribute-filter.xml, as usual.
Done.
-peter
</pre>
</blockquote>
<br>
</body>
</html>