<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:681973215;
mso-list-type:hybrid;
mso-list-template-ids:-1745857464 515041098 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:2018;
mso-level-number-format:bullet;
mso-level-text:\F0D8;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:1865711098;
mso-list-type:hybrid;
mso-list-template-ids:-1859880454 -1288019820 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-start-at:2018;
mso-level-number-format:bullet;
mso-level-text:\F0D8;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Well, I finally got Shibboleth SSO working for Net Partner. Thank you all for assisting, especially Tony. I will perform some clean up of my configs and provide a summary.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The most recent issue was fixed by changing where I specified the NameIDFormat, which I had in the Net Partner metadata file. I had the following:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--- metadata ---<o:p></o:p></p>
<p class="MsoNormal"><EntityDescriptor entityID="NetPartner"<o:p></o:p></p>
<p class="MsoNormal"> xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><o:p></o:p></p>
<p class="MsoNormal"> <SPSSODescriptor<o:p></o:p></p>
<p class="MsoNormal"> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol<o:p></o:p></p>
<p class="MsoNormal"> urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol"><o:p></o:p></p>
<p class="MsoNormal"> <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat><o:p></o:p></p>
<p class="MsoNormal"> <AssertionConsumerService index="1"<o:p></o:p></p>
<p class="MsoNormal"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<o:p></o:p></p>
<p class="MsoNormal"> Location="https://myfapprd.taylor.edu/NetPartnerStudent/Logon.aspx"/><o:p></o:p></p>
<p class="MsoNormal"> </SPSSODescriptor><o:p></o:p></p>
<p class="MsoNormal"></EntityDescriptor><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The change that got Net Partner SSO working for was removing the sixth line (i.e., the <NameIDFormat> specification from the metadata file. Instead, I placed the specification as a nameIDFormatPrecedence entry in reying-party.xml as follows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--- NetPartner entry for relying-party.xml ---<o:p></o:p></p>
<p class="MsoNormal"> <bean parent="RelyingPartyByName" c:relyingPartyIds="NetPartner"><o:p></o:p></p>
<p class="MsoNormal"> <property name="profileConfigurations"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="Shibboleth.SSO" p:securityConfiguration-ref="SHA1SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML1.AttributeQuery" p:securityConfiguration-ref="SHA1SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML1.ArtifactResolution" p:securityConfiguration-ref="SHA1SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.ECP" p:securityConfiguration-ref="SHA1SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.Logout" p:securityConfiguration-ref="SHA1SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.AttributeQuery" p:securityConfiguration-ref="SHA1SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.ArtifactResolution" p:securityConfiguration-ref="SHA1SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.SSO"<o:p></o:p></p>
<p class="MsoNormal"> p:encryptAssertions="false"<o:p></o:p></p>
<p class="MsoNormal"> p:securityConfiguration-ref="SHA1SecurityConfig"<o:p></o:p></p>
<p class="MsoNormal"> p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'}}"<o:p></o:p></p>
<p class="MsoNormal"> /><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I admit to being confused why this change worked—it seems like it should have worked in my metadata file.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In response to Peter’s suggestion that I “…avoid using the ‘unspecified’ (nameid-format) if at all possible”, I tried another value, only to have things break for me. It seems that the ‘unspecified’ settings is what works here.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Again, I will post a summary of all of my Shibboleth and Net Partner configs for supporting PowerFAIDS Net Partner SSO. This might take me a couple days or so.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Carl<o:p></o:p></p>
</div>
<br>
<br>
<font face="Gill Sans Regular, Gill Sans MT, Trebuchet MS, Helvetica" color="888888" size="2">The information in this communication is intended solely for the individual or entity to whom it is addressed. It may contain confidential or legally privileged information.
If you are not the intended recipient, any disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited, and may be unlawful. If you have received this communication in error, please notify us immediately by responding
to the sender of this email, and then delete it from your system. Taylor University is not liable for the inaccurate or improper transmission of the information contained in this communication or for any delay in its receipt.</font>
</body>
</html>