<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
PS, we found an existing Cherwell ticket with that <b>InvalidNameIDPolicy
</b>error that we’re seeing. It <i>indicates that the “Type of ID”
should be looked at:</i><i><br>
</i><i><br>
</i><i>Note: This ID needs to match the ID the SAML provider is
sending back to us</i><i><br>
</i><i><br>
</i><i>If Cherwell has the correct ID type, have the Identity
Provider (ADFS, Shibboleth, etc) check the ID they are sending to
us. </i><i><br>
</i><i>
</i>
<ul style="margin-top:0in" type="disc">
<li class="MsoNormal"><i>Windows Login = Kerberos Principal Name
(i.e. DOMAIN\username) or the SAMAccountName</i></li>
<li class="MsoNormal"><i>E-mail address = E-mail address with
domain (i.e. <a class="moz-txt-link-abbreviated" href="mailto:username@domain.com">username@domain.com</a>)</i></li>
</ul>
<br>
This is my our attribute-resolver.xml & attribute-filter.xml
files have what I listed below. Or our stab at what we believe.<tt>
</tt><br>
<br>
DL<br>
<br>
<div class="moz-cite-prefix">On 4/26/19 4:55 PM, Lohr, Donald wrote:<br>
</div>
<blockquote type="cite"
cite="mid:5ea9b40a-77d2-c9ee-23c1-58f6c7043b6e@jmu.edu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Not wanting to share too much specific data, which was why I
mentioned off-line.<br>
<br>
We are not specifically wanting to Shib the thick client, but the
portal. We are not choosing the email address, but Windows Login
(not using email is a long story in and of itself). In the SP
metadata is:<br>
<br>
<tt><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat></tt><tt><br>
</tt><tt><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:<b>nameid-format:kerberos</b></md:NameIDFormat></tt><tt><br>
</tt><br>
Attempting to follow two different on-line Cherwell documents
(public) we guessed and put the following in our respected IdP
files:<br>
<br>
<tt>attribute-resolver.xml </tt><tt><br>
</tt><tt><resolver:AttributeDefinition id="sAMAccountName"
xsi:type="ad:Simple" sourceAttributeID="cn"> </tt><tt><br>
</tt><tt> <resolver:Dependency ref="oud" /> </tt><tt><br>
</tt><tt> <resolver:AttributeEncoder
xsi:type="enc:SAML2String"
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
name="sAMAccountName" encodeType="false" /> </tt><tt><br>
</tt><tt></resolver:AttributeDefinition> </tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt>attribute-filter.xml </tt><tt><br>
</tt><tt><afp:AttributeFilterPolicy id="cherwellportal"> </tt><tt><br>
</tt><tt> <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value=</tt><tt><a
class="moz-txt-link-rfc2396E"
href="https://it-itsmtrn.jmu.edu/CherwellClient"
moz-do-not-send="true">"https://xxxx.sss.ccc/CherwellClient"</a></tt><tt>
/> </tt><tt><br>
</tt><tt> <afp:AttributeRule
attributeID="sAMAccountName"> </tt><tt><br>
</tt><tt> <afp:PermitValueRule
xsi:type="basic:ANY" /> </tt><tt><br>
</tt><tt> </afp:AttributeRule> </tt><tt><br>
</tt><tt></afp:AttributeFilterPolicy></tt> <br>
<br>
But we get the following error at login:<br>
<br>
<pre class="moz-quote-pre" wrap=""><b>SAML Auth failed: An error occured, SAML status codes:
urn:oasis:names:tc:SAML:2.0:status:Requestor,
urn:oassis:names:tc:SAML:2.0:status:InvalidNameIDPolicy
</b>
</pre>
We are running Cherwell v9.3.5.x and our Shib IdP is v3.3.3. Our
Shib IdP is back by a non-AD LDAP directory.<br>
<br>
There online docs do not seem to use Shib 3.x speak in their
examples.<br>
<br>
Thx,<br>
DL<br>
<br>
<div class="moz-cite-prefix">On 4/26/19 4:18 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:19843BD9-E9D2-49BF-8352-269417846D34@osu.edu">
<pre class="moz-quote-pre" wrap="">I did a quick review. It's almost vanilla, I'm sending it a NameID in emailAddress format. It had a key and supports encryption. It didn't used to support SHA-2 signatures, but does now. The non-vanilla bit was that I was never able to get it to accept signed responses alone (it claims to, but it didn't work last I tested), so I had to toggle the metadata for it to trigger assertion signing, and that was about all.
-- Scott
</pre>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
<br>
</body>
</html>