<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
font-variant:normal !important;
color:#595959;
text-transform:none;
position:relative;
top:0pt;
mso-text-raise:0pt;
letter-spacing:0pt;
mso-contextual-alternates:no;
font-weight:normal;
font-style:normal;
text-decoration:none none;
vertical-align:baseline;}
span.hljs-tag
{mso-style-name:hljs-tag;}
span.hljs-name
{mso-style-name:hljs-name;}
span.hljs-attr
{mso-style-name:hljs-attr;}
span.hljs-string
{mso-style-name:hljs-string;}
span.text-node-whitespace
{mso-style-name:text-node-whitespace;}
span.text-node
{mso-style-name:text-node;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">We're moving our SP onto Shib 3.0.2. Our SP handles SAML authentication for multiple services, we only support SP initiated session, we only have one SP entityID. Our SAML authn request is a default
one:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy"><</span></span><span class="hljs-name"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">samlp:AuthnRequest</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">xmlns:samlp</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"urn:oasis:names:tc:SAML:2.0:protocol"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">AssertionConsumerServiceURL</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"https://some.sp/POST"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">Destination</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"https://some.idp/adfs/ls/"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">ID</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"_bba61a772492df9b6c11ef5fb6bab333"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">IssueInstant</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"2019-01-15T10:41:47Z"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">ProtocolBinding</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">Version</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"2.0"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">></span></span><span class="text-node-whitespace"><span style="font-size:7.5pt;font-family:"Courier New";color:#333333">
</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy"><</span></span><span class="hljs-name"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">saml:Issuer</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">xmlns:saml</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"urn:oasis:names:tc:SAML:2.0:assertion"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">></span></span><span class="text-node"><b><span style="font-size:7.5pt;font-family:"Courier New";color:#333333">https://some.sp.com/</span></b></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy"></</span></span><span class="hljs-name"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">saml:Issuer</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">></span></span><span class="text-node-whitespace"><span style="font-size:7.5pt;font-family:"Courier New";color:#333333">
</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy"><</span></span><span class="hljs-name"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">samlp:NameIDPolicy</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
</span></span><span class="hljs-attr"><span style="font-size:7.5pt;font-family:"Courier New";color:teal">AllowCreate</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">=</span></span><span class="hljs-string"><span style="font-size:7.5pt;font-family:"Courier New";color:#DD1144">"1"</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">
/></</span></span><span class="hljs-name"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">samlp:AuthnRequest</span></span><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy">><o:p></o:p></span></span></p>
<p class="MsoNormal"><span class="hljs-tag"><span style="font-size:7.5pt;font-family:"Courier New";color:navy"><o:p> </o:p></span></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">and we want to keep it that way.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">To offer personalization we use ePTID attribute or a persistent NameID subject. A persistent NameID is mostly used by corp/gov IdPs. There's a bunch of IdPs with AzureAD managing their SAML authn.
AzureAD is unable to release a persistent NameID unless the SP requests it in SAML request. (It's crazy to let a 3<sup>rd</sup> party SP control what your IdP releases but there's no way around this.)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">Q: Is it possible to modify SP SAML authn request per IdP and if yes, how do we go about it? We know in advance which entityIDs would require it. Going through this:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><a href="https://wiki.shibboleth.net/confluence/display/SP3/SSO">https://wiki.shibboleth.net/confluence/display/SP3/SSO</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">and<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><a href="https://wiki.shibboleth.net/confluence/display/SP3/RelyingParty">https://wiki.shibboleth.net/confluence/display/SP3/RelyingParty</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">and maybe<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><a href="https://wiki.shibboleth.net/confluence/display/SP3/EntityMatcher">https://wiki.shibboleth.net/confluence/display/SP3/EntityMatcher</a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">it looks like it is... but it still isn't clear to me (I am not a developer) whether the SP can be configured to "please add a requirement for a persistent NameID to SAML authn request to entityIDs
'X' and 'Y', and send a default SAML request to all other entityIDs" and if yes, how do we do that.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">A pointer or advice would be appreciated.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959">Meshna<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-GB" style="color:#595959">Meshna Koren</span></b><b><span lang="EN-GB" style="font-size:9.0pt;color:#595959">
<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:9.0pt;color:#595959"><br>
</span><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#595959">Integration Manager<o:p></o:p></span></i></p>
<p class="MsoNormal"><b><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#595959">Product Management - Identity and Platform</span></i></b><b><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#595959">
- </span></i></b><b><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#595959">Research Products</span></i></b><b><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#595959"><o:p></o:p></span></i></b></p>
<p class="MsoNormal"><b><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#1F497D"><o:p> </o:p></span></i></b></p>
<p class="MsoNormal"><b><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#E36C0A">Elsevier BV</span></i></b><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#1F497D"><o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#595959">Radarweg 29, Amsterdam 1043 NX, The Netherlands<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#1F497D"><a href="mailto:m.koren@elsevier.com"><span style="color:blue">m.koren@elsevier.com</span></a><o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#1F497D"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#E36C0A">Federated Access - SAML, Shibboleth, Corporate SSO, OpenAthens, Institutional Login<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-GB" style="font-size:9.0pt;font-family:"Cambria",serif;color:#E36C0A"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><span style="color:#595959"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="color:#595959"><o:p> </o:p></span></p>
</div>
<style>P {margin:0cm:margin-bottomL.0001pt;}</style><br>
<hr>
<p><span style="font-size:10pt;font-family:"Arial","sans-serif"">Elsevier B.V. Registered Office: Radarweg 29, 1043 NX Amsterdam, The Netherlands, Registration No. 33156677, Registered in The Netherlands.</span>
<br clear="none">
</p>
</body>
</html>