<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Not wanting to share too much specific data, which was why I
mentioned off-line.<br>
<br>
We are not specifically wanting to Shib the thick client, but the
portal. We are not choosing the email address, but Windows Login
(not using email is a long story in and of itself). In the SP
metadata is:<br>
<br>
<tt><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat></tt><tt><br>
</tt><tt><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:<b>nameid-format:kerberos</b></md:NameIDFormat></tt><tt><br>
</tt><br>
Attempting to follow two different on-line Cherwell documents
(public) we guessed and put the following in our respected IdP
files:<br>
<br>
<tt>attribute-resolver.xml </tt><tt><br>
</tt><tt><resolver:AttributeDefinition id="sAMAccountName"
xsi:type="ad:Simple" sourceAttributeID="cn"> </tt><tt><br>
</tt><tt> <resolver:Dependency ref="oud" /> </tt><tt><br>
</tt><tt> <resolver:AttributeEncoder
xsi:type="enc:SAML2String"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
name="sAMAccountName" encodeType="false" /> </tt><tt><br>
</tt><tt></resolver:AttributeDefinition> </tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt>attribute-filter.xml </tt><tt><br>
</tt><tt><afp:AttributeFilterPolicy id="cherwellportal"> </tt><tt><br>
</tt><tt> <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value=</tt><tt><a
class="moz-txt-link-rfc2396E"
href="https://it-itsmtrn.jmu.edu/CherwellClient">"https://xxxx.sss.ccc/CherwellClient"</a></tt><tt>
/> </tt><tt><br>
</tt><tt> <afp:AttributeRule
attributeID="sAMAccountName"> </tt><tt><br>
</tt><tt> <afp:PermitValueRule
xsi:type="basic:ANY" /> </tt><tt><br>
</tt><tt> </afp:AttributeRule> </tt><tt><br>
</tt><tt></afp:AttributeFilterPolicy></tt> <br>
<br>
But we get the following error at login:<br>
<br>
<pre class="moz-quote-pre" wrap=""><b>SAML Auth failed: An error occured, SAML status codes:
urn:oasis:names:tc:SAML:2.0:status:Requestor,
urn:oassis:names:tc:SAML:2.0:status:InvalidNameIDPolicy
</b>
</pre>
We are running Cherwell v9.3.5.x and our Shib IdP is v3.3.3. Our
Shib IdP is back by a non-AD LDAP directory.<br>
<br>
There online docs do not seem to use Shib 3.x speak in their
examples.<br>
<br>
Thx,<br>
DL<br>
<br>
<div class="moz-cite-prefix">On 4/26/19 4:18 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:19843BD9-E9D2-49BF-8352-269417846D34@osu.edu">
<pre class="moz-quote-pre" wrap="">I did a quick review. It's almost vanilla, I'm sending it a NameID in emailAddress format. It had a key and supports encryption. It didn't used to support SHA-2 signatures, but does now. The non-vanilla bit was that I was never able to get it to accept signed responses alone (it claims to, but it didn't work last I tested), so I had to toggle the metadata for it to trigger assertion signing, and that was about all.
-- Scott
</pre>
</blockquote>
<br>
</body>
</html>