<div dir="ltr"><div dir="ltr">Matthew and Scott,</div><div dir="ltr"><br></div><div dir="ltr">Thank you so much for the additional help here. That is very insightful. And yes, Matthew, your assumptions are correct. Having the examples provided will be great!</div><div dir="ltr"><br></div><div>MC</div><div dir="ltr"><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="line-height:19.8px"><font face="arial, helvetica, sans-serif"><span style="font-size:12.8px"><p dir="ltr" style="font-weight:bold;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;vertical-align:baseline;white-space:pre-wrap">Mary-Catherine Martinez</span></p><p dir="ltr" style="font-weight:bold;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:10pt;color:rgb(13,13,13);background-color:transparent;font-weight:400;vertical-align:baseline;white-space:pre-wrap">Software Implementation Specialist | InnoSoft Canada Inc.</span></p><p dir="ltr" style="font-weight:bold;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;color:rgb(0,0,0);background-color:transparent;font-weight:400;vertical-align:baseline;white-space:pre-wrap"><img src="https://lh5.googleusercontent.com/8PQnr6b3LUhWOvN_Yhuo8s_uzByROvvbIPGCdr_ztH9ej8QqfRx0MzswXAB-gFfSLay3x00Ayb0T9F9inr0DErfVHuIyCMu6DuHE2pqjpOLx6N07OFkWG8TH9-B8cXE0WByA4flt" width="12" height="12" style="border:none"></span><span style="font-size:11pt;color:rgb(0,0,0);background-color:transparent;font-weight:400;vertical-align:baseline;white-space:pre-wrap"> </span><span style="font-size:9pt;color:rgb(89,89,89);background-color:transparent;font-weight:400;vertical-align:baseline;white-space:pre-wrap"><span id="gc-number-1430" class="gc-cs-link" title="Call with Google Voice">888.510.3827</span> ext. 712</span></p><p dir="ltr" style="font-weight:bold;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="font-size:11pt;color:rgb(0,0,0);background-color:transparent;font-weight:400;vertical-align:baseline;white-space:pre-wrap"><img src="https://lh3.googleusercontent.com/1p7TaxVT_hVCXCAKPEjxiEjrVLP86B5cAHNRbU0KkfDBep3OpGHtlERcUhOUfp7kAhNvH0ChfKJPrsyXEu8qHQaRJmkLtmHpmHAkkHU3b4qvwHE3ZBLQEXy0PXb_ivW8RrVbMXBv" width="12" height="12" style="border:none"></span><span style="font-size:9pt;color:rgb(89,89,89);background-color:transparent;vertical-align:baseline;white-space:pre-wrap"> </span><a href="mailto:mc.martinez@innosoft.ca" style="color:rgb(17,85,204)" target="_blank"><span style="font-size:9pt;background-color:transparent;font-weight:400;vertical-align:baseline;white-space:pre-wrap">mc.martinez@innosoft.ca</span></a></p><span style="font-weight:700;font-size:9pt;color:rgb(89,89,89);background-color:transparent;vertical-align:baseline;white-space:pre-wrap"><img src="https://lh4.googleusercontent.com/nDwKQrJNO5e6ue2Bo4EIMhV4zSEtVlqKhepqP9EvcGspjgNsF-PpxKj5h26KOXPhwkpBdtH9NDmPFw8ap05mchXsuI-VE28OV85Wdsu-_a9Iu0oEiHMfFjARtwrkX2Le0bj0BlAd" width="12" height="12" style="border:none"></span><span style="font-size:8pt;color:rgb(166,166,166);background-color:transparent;vertical-align:baseline;white-space:pre-wrap"> </span><a href="http://www.innosoftfusion.com/" style="color:rgb(17,85,204);font-weight:bold" target="_blank"><span style="font-size:9pt;background-color:transparent;font-weight:400;vertical-align:baseline;white-space:pre-wrap">www.innosoftfusion.com</span></a></span></font><br></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Feb 28, 2019 at 10:00 AM <<a href="mailto:users-request@shibboleth.net">users-request@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send users mailing list submissions to<br>
<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://shibboleth.net/mailman/listinfo/users" rel="noreferrer" target="_blank">https://shibboleth.net/mailman/listinfo/users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:users-request@shibboleth.net" target="_blank">users-request@shibboleth.net</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:users-owner@shibboleth.net" target="_blank">users-owner@shibboleth.net</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. RE: General Shib IdP install/config help (Matthew X. Economou)<br>
2. Re: General Shib IdP install/config help (Cantor, Scott)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 27 Feb 2019 12:22:15 -0500<br>
From: "Matthew X. Economou" <<a href="mailto:xenophon@irtnog.org" target="_blank">xenophon@irtnog.org</a>><br>
To: "Shib Users" <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
Cc: Eric Weber <<a href="mailto:eric.weber@innosoft.ca" target="_blank">eric.weber@innosoft.ca</a>>, Tony Autin<br>
<<a href="mailto:tony.autin@innosoft.ca" target="_blank">tony.autin@innosoft.ca</a>><br>
Subject: RE: General Shib IdP install/config help<br>
Message-ID:<br>
<<a href="mailto:BABF8C57A778F04791343E560165990823718E@cinip100ntsbs.irtnog.net" target="_blank">BABF8C57A778F04791343E560165990823718E@cinip100ntsbs.irtnog.net</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Mary-Catherine Martinez writes:<br>
<br>
> I'm looking for a somewhat user-friendly guide on how to setup a Shib<br>
> IdP from scratch. We're trying to deploy this via AWS Cognito to manage<br>
> users/accounts and a Windows/EC2 server on AWS... This is one particular<br>
> area that we are struggling with:<br>
> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration</a><br>
<br>
If I understand you correctly, you're deploying a Shibboleth IdP on a Windows-based EC2 instance, and you're configuring AWS Cognito to use that IdP to authenticate users.<br>
<br>
According to the AWS Cognito developer guide (<a href="https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html" rel="noreferrer" target="_blank">https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html</a>), you would configure your Shibboleth IdP to consume the AWS SP metadata at <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html" rel="noreferrer" target="_blank">https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html</a>. In my case, I've added the following to my metadata-providers.xml file:<br>
<br>
<MetadataProvider<br>
metadataURL="<a href="https://signin.aws.amazon.com/static/saml-metadata.xml" rel="noreferrer" target="_blank">https://signin.aws.amazon.com/static/saml-metadata.xml</a>"<br>
xsi:type="FileBackedHTTPMetadataProvider"<br>
backingFile="%{idp.home}/metadata/d1400bed2d51772ab34da144f5c65222.xml"<br>
id="_d1400bed2d51772ab34da144f5c65222"/><br>
<br>
You also need to configure the IdP to release the necessary attributes to the Cognito service. This requires adding several attribute definitions to attribute-resolver.xml, such as the following examples from my configuration:<br>
<br>
<AttributeDefinition xsi:type="Simple" id="AmazonWebServicesIAMRole"<br>
sourceAttributeID="aws_role"><br>
<Dependency ref="staticAttributes"/><br>
<AttributeEncoder xsi:type="SAML2String" encodeType="false"<br>
name="<a href="https://aws.amazon.com/SAML/Attributes/Role" rel="noreferrer" target="_blank">https://aws.amazon.com/SAML/Attributes/Role</a>" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple" id="AmazonWebServicesIAMRoleSessionName"<br>
sourceAttributeID="uid"><br>
<Dependency ref="uid"/><br>
<AttributeEncoder xsi:type="SAML2String" encodeType="false"<br>
name="<a href="https://aws.amazon.com/SAML/Attributes/RoleSessionName" rel="noreferrer" target="_blank">https://aws.amazon.com/SAML/Attributes/RoleSessionName</a>" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple" id="AmazonWebServicesIAMSessionDuration"<br>
sourceAttributeID="aws_session_duration"><br>
<Dependency ref="staticAttributes"/><br>
<AttributeEncoder xsi:type="SAML2String" encodeType="false"<br>
name="<a href="https://aws.amazon.com/SAML/Attributes/SessionDuration" rel="noreferrer" target="_blank">https://aws.amazon.com/SAML/Attributes/SessionDuration</a>" /><br>
</AttributeDefinition><br>
<br>
Note the "sourceAttributeID" attributes and "Dependency" references. These refer to other claims (such as "uid") or to data connectors (such as "staticAttributes"). For simplicity's sake, here's an example of a data connector that generates static values for the IAM role and session duration claims:<br>
<br>
<DataConnector id="staticAttributes" xsi:type="Static"><br>
<Attribute id="aws_role"><br>
<Value>arn:aws:iam::123:role/MyRole,arn:aws:iam::123:saml-provider/MyIdP</Value><br>
</Attribute><br>
<Attribute id="aws_session_duration"><br>
<Value>43200</Value><br>
</Attribute><br>
</DataConnector><br>
<br>
It's also possible to generate the necessary values from information provided by a data connector, such an an LDAP directory, but I believe this requires writing some Java. <br>
<br>
Best wishes,<br>
Matthew<br>
<br>
-- <br>
"The lyf so short, the craft so longe to lerne."<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 27 Feb 2019 17:38:09 +0000<br>
From: "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>><br>
To: Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
Cc: Eric Weber <<a href="mailto:eric.weber@innosoft.ca" target="_blank">eric.weber@innosoft.ca</a>>, Tony Autin<br>
<<a href="mailto:tony.autin@innosoft.ca" target="_blank">tony.autin@innosoft.ca</a>><br>
Subject: Re: General Shib IdP install/config help<br>
Message-ID: <<a href="mailto:8892BA3F-AF61-4D2C-9098-CCC0A08D3A5A@osu.edu" target="_blank">8892BA3F-AF61-4D2C-9098-CCC0A08D3A5A@osu.edu</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
On 2/27/19, 12:22 PM, "users on behalf of Matthew X. Economou" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:xenophon@irtnog.org" target="_blank">xenophon@irtnog.org</a>> wrote:<br>
<br>
> If I understand you correctly, you're deploying a Shibboleth IdP on a Windows-based EC2 instance, and you're<br>
> configuring AWS Cognito to use that IdP to authenticate users.<br>
<br>
If the question is specifically about Cognito as an SP, I also documented that, it's in the IntegrationGuides section, which I moved recently over to the KB space where it won't get confined to the V3 doc space.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/KB/AmazonCognito" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/KB/AmazonCognito</a><br>
<br>
-- Scott<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
<br>
------------------------------<br>
<br>
End of users Digest, Vol 92, Issue 26<br>
*************************************<br>
</blockquote></div></div>