<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">I copied the V2 config attribute-resolver.xml and attribute-filter.xml files onto the V3 server
<o:p></o:p></p>
<p class="MsoPlainText">The saml-nameid.properties are configured for legacy.<o:p></o:p></p>
<p class="MsoPlainText"># Comment out to disable legacy NameID generation via Attribute Resolver<o:p></o:p></p>
<p class="MsoPlainText">idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator<o:p></o:p></p>
<p class="MsoPlainText">idp.nameid.saml1.legacyGenerator = shibboleth.LegacySAML1NameIdentifierGenerator<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The result is the same as before Access Is Denied.<o:p></o:p></p>
<p class="MsoPlainText">The report from the SP <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><img width="574" height="223" style="width:5.9791in;height:2.3229in" id="Picture_x0020_1" src="cid:image003.jpg@01D42E5D.E2210CC0"><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Back when we first created a login for our SP we used this documentation.
<o:p></o:p></p>
<p class="MsoPlainText">1. have a deny policy to not release transient ID <o:p></o:p></p>
<p class="MsoPlainText">2. new definition for username in resolver the username not as string, but nameid
<o:p></o:p></p>
<p class="MsoPlainText">3. release this username to SP<o:p></o:p></p>
<p class="MsoPlainText">4. nameid's cannot be encrypted<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In our Attribute-Filter.xml we have <o:p></o:p></p>
<p class="MsoPlainText">STEP 1:<o:p></o:p></p>
<p class="MsoPlainText"> <afp:AttributeFilterPolicy id="releaseTransientId"><o:p></o:p></p>
<p class="MsoPlainText"> <afp:PolicyRequirementRule xsi:type="basic:NOT"><o:p></o:p></p>
<p class="MsoPlainText"> <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://xxxx-stg.saasit.com/" /><o:p></o:p></p>
<p class="MsoPlainText"> </afp:PolicyRequirementRule><o:p></o:p></p>
<p class="MsoPlainText"> <afp:AttributeRule attributeID="transientId"><o:p></o:p></p>
<p class="MsoPlainText"> <afp:PermitValueRule xsi:type="basic:ANY"/><o:p></o:p></p>
<p class="MsoPlainText"> </afp:AttributeRule><o:p></o:p></p>
<p class="MsoPlainText"> </afp:AttributeFilterPolicy><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">STEP 2:<o:p></o:p></p>
<p class="MsoPlainText"><resolver:AttributeDefinition id="Login" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"<o:p></o:p></p>
<p class="MsoPlainText"> sourceAttributeID="sAMAccountName"><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:Dependency ref="myAD" /><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
<o:p></o:p></p>
<p class="MsoPlainText"> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:transient" /><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<o:p></o:p></p>
<p class="MsoPlainText"> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /><o:p></o:p></p>
<p class="MsoPlainText"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">STEP 3:<o:p></o:p></p>
<p class="MsoPlainText"><AttributeFilterPolicy id="releaseLoginToSAASIT"><o:p></o:p></p>
<p class="MsoPlainText"> <PolicyRequirementRule xsi:type="Requester" value="https://uncp-stg.saasit.com/" /><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <AttributeRule attributeID="Login"><o:p></o:p></p>
<p class="MsoPlainText"> <PermitValueRule xsi:type="ANY" /><o:p></o:p></p>
<p class="MsoPlainText"> </AttributeRule><o:p></o:p></p>
<p class="MsoPlainText"> </AttributeFilterPolicy><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I copied the relying-party.xml.dist file and inserted the part for the SP.<o:p></o:p></p>
<p class="MsoPlainText">Relying-Party.xml<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">STEP 4. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><!-- Container for any overrides you want to add. --><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <util:list id="shibboleth.RelyingPartyOverrides"><o:p></o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
<p class="MsoPlainText"> <!--
<o:p></o:p></p>
<p class="MsoPlainText"> Override example that identifies a single RP by name and configures it<o:p></o:p></p>
<p class="MsoPlainText"> for SAML 2 SSO without encryption. This is a common "vendor" scenario.<o:p></o:p></p>
<p class="MsoPlainText"> --><o:p></o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="RelyingPartyByName" c:relyingPartyIds="https://xxxx-stg.saasit.com/"><o:p></o:p></p>
<p class="MsoPlainText"> <property name="profileConfigurations"><o:p></o:p></p>
<p class="MsoPlainText"> <list><o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="SAML2.SSO" p:encryptNameIDs="false" p:encryptAssertions="false" /><o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="SAML2.AttributeQuery" p:encryptAssertions="false" p:encryptNameIDs="false" /><o:p></o:p></p>
<p class="MsoPlainText"> </list><o:p></o:p></p>
<p class="MsoPlainText"> </property><o:p></o:p></p>
<p class="MsoPlainText"> </bean><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> </util:list><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">But the result is still the same.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: users <users-bounces@shibboleth.net> On Behalf Of Peter Schober<br>
Sent: Wednesday, August 01, 2018 11:23 AM<br>
To: users@shibboleth.net<br>
Subject: Re: Access Denied</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">* Tabitha O. Locklear <<a href="mailto:tabithao.locklear@uncp.edu"><span style="color:windowtext;text-decoration:none">tabithao.locklear@uncp.edu</span></a>> [2018-08-01 17:18]:<o:p></o:p></p>
<p class="MsoPlainText">> I had so much time into building the V3 and I had all but two SP's
<o:p></o:p></p>
<p class="MsoPlainText">> working, I felt that it would be a simple fix ; but not understanding
<o:p></o:p></p>
<p class="MsoPlainText">> the syntax has made if far too difficult.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I have tried to provide an answer to your original problem report.<o:p></o:p></p>
<p class="MsoPlainText">If you don't understand something or need more detailed explanations you could ask (even if the reply might be a pointer to existing documentation).<o:p></o:p></p>
<p class="MsoPlainText">-peter<o:p></o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
<span style="color:windowtext;text-decoration:none">https://wiki.shibboleth.net/confluence/x/coFAAg</span></a><o:p></o:p></p>
<p class="MsoPlainText">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
<span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
</div>
</body>
</html>