<div dir="ltr"><div dir="ltr">UAlaska is currently using Cherwell Service Management with Shibb 3.3.1 and 3.4.3 instances of IdP with no config differences.<div><br></div><div>Two unusual aspects of Cherwell:</div><div><br></div><div>1. Both thick (Windows) clients and web browser interface is supported. To support both as seamlessly as possible, our AD team asked that we identify users of the web client with an identifier including the Windows domain, like ua\username. This required ginning up that identifier in attribute-resolver.xml</div><div><br></div><div>2. Cherwell did (at least when we first integrated access with Shibboleth years ago) require a subject nameID with "kerberos" format. We did this integration with the initial roll-out of Cherwell with on-site vendor support. My recollection is that we tried other formats but were unable to get the SP to accept the assertion without that kerberos format (Scott's 1% perhaps?), which was in turn modeled on the vendor's experience at another famous University.</div><div><br></div><div>To accommodate these requirements, we have the following customizations for Cherwell in our Shibboleth config <br>(you may consider these inconsistent, stupid or wrong, but they've been working reliably for us):</div><div><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(33,118,199)"><br></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;font-family:Menlo"><font color="#000000">in attribute-resolver.xml:</font></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(33,118,199)"><br></p><p class="gmail-p1" style="margin:0px;font:10px Menlo;color:rgb(129,144,144)"><!-- build an attribute to use with Cherwell: value = ua\uausername --></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><AttributeDefinition</p><p class="gmail-p3" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s2" style="color:rgb(189,54,19)">id=</span>"domainUsername"</p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span><span class="gmail-s2" style="color:rgb(189,54,19)">xsi:type=</span><span class="gmail-s3" style="color:rgb(165,119,5)">"ScriptedAttribute"</span><span class="gmail-Apple-converted-space"> </span></p><p class="gmail-p3" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(115,138,4)">xmlns:xsi=</span>"<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</p><p class="gmail-p3" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(115,138,4)">xmlns:resolver=</span>"urn:mace:shibboleth:2.0:resolver"<span class="gmail-s1" style="color:rgb(33,118,199)">></span></p><p class="gmail-p1" style="margin:0px;font:10px Menlo;color:rgb(129,144,144)"><!-- use UA Username ~netid previously resolved --></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-s5" style="color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span></span><Dependency <span class="gmail-s2" style="color:rgb(189,54,19)">ref=</span><span class="gmail-s3" style="color:rgb(165,119,5)">"uaUsername"</span> /></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-s5" style="color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span></span><AttributeEncoder</p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span><span class="gmail-s2" style="color:rgb(189,54,19)">xsi:type=</span><span class="gmail-s3" style="color:rgb(165,119,5)">"SAML2String"</span><span class="gmail-Apple-converted-space"> </span></p><p class="gmail-p3" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s2" style="color:rgb(189,54,19)">name=</span>"urn:oid:1.3.6.1.4.1.5923.1.1.1.6"</p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span><span class="gmail-s2" style="color:rgb(189,54,19)">friendlyName=</span><span class="gmail-s3" style="color:rgb(165,119,5)">"username"</span> /></p><p class="gmail-p4" style="margin:0px;font:10px Menlo;color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span><span class="gmail-s1" style="color:rgb(33,118,199)"><Script></span></p><p class="gmail-p4" style="margin:0px;font:10px Menlo;color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span><![CDATA[</p><p class="gmail-p4" style="margin:0px;font:10px Menlo;color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span>usernamewodomain = uaUsername.getValues().get(0);</p><p class="gmail-p4" style="margin:0px;font:10px Menlo;color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span>domainUsername.addValue("ua\\" + uaUsername.getValues().get(0));</p><p class="gmail-p4" style="margin:0px;font:10px Menlo;color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span>logger.debug("added domain to username witih result = " + domainUsername.getValues() );</p><p class="gmail-p4" style="margin:0px;font:10px Menlo;color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span>]]></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-s5" style="color:rgb(71,91,98)"><span class="gmail-Apple-converted-space"> </span></span></Script></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(33,118,199)">
</p><p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(33,118,199)"></AttributeDefinition></p><p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(33,118,199)"><br></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;font-family:Menlo;margin:0px"><font color="#000000">in saml-nameid.xml:</font></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(33,118,199)"><br></p><p class="gmail-p1" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(129,144,144)"><!-- Kerberos NameId for Cherwell --></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><bean </span><span class="gmail-s2" style="color:rgb(189,54,19)">parent=</span>"shibboleth.SAML2AttributeSourcedGenerator"<span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s2" style="color:rgb(189,54,19)">format=</span>"urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos"<span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s2" style="color:rgb(189,54,19)">attributeSourceIds=</span>"#{ {'domainUsername'} }"<span class="gmail-s1" style="color:rgb(33,118,199)">></span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-s3" style="color:rgb(71,91,98)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></span><span class="gmail-s1" style="color:rgb(33,118,199)"><property </span><span class="gmail-s2" style="color:rgb(189,54,19)">name=</span>"activationCondition"<span class="gmail-s1" style="color:rgb(33,118,199)">></span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-s3" style="color:rgb(71,91,98)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></span><span class="gmail-s1" style="color:rgb(33,118,199)"><bean </span><span class="gmail-s2" style="color:rgb(189,54,19)">parent=</span>"shibboleth.Conditions.RelyingPartyId"<span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(33,118,199)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s2" style="color:rgb(189,54,19)">candidates=</span>"#{ { <span class="gmail-Apple-converted-space"> </span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> <span class="gmail-Apple-converted-space"> </span>'<a href="https://ualaska.cherwellondemand.com">https://ualaska.cherwellondemand.com</a>', <span class="gmail-Apple-converted-space"> </span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> <span class="gmail-Apple-converted-space"> </span>'<a href="https://ualaskatest.cherwellondemand.com">https://ualaskatest.cherwellondemand.com</a>' <span class="gmail-Apple-converted-space"> </span></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(165,119,5)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> <span class="gmail-Apple-converted-space"> </span>} }"<span class="gmail-s1" style="color:rgb(33,118,199)">/></span></p><p class="gmail-p3" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(33,118,199)"><span class="gmail-s3" style="color:rgb(71,91,98)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></span></property></p><p class="gmail-p2" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(33,118,199)"></p><p class="gmail-p3" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(33,118,199)"></bean></p><p class="gmail-p3" style="font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;margin:0px;color:rgb(33,118,199)"><br></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;font-family:Menlo"><font color="#000000" style="">As a result the resulting SAML assertion to Cherwell, prior to encryption, includes:</font></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(33,118,199)"><br></p><p class="gmail-p1" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><Subject></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(71,91,98)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></span><span class="gmail-s2" style="color:rgb(33,118,199)"><saml2:NameID </span><span class="gmail-s3" style="color:rgb(115,138,4)">xmlns:saml2=</span>"urn:oasis:names:tc:SAML:2.0:assertion"<span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(189,54,19)">Format=</span>"urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos"<span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(189,54,19)">NameQualifier=</span>"urn:mace:incommon:<a href="http://alaska.edu">alaska.edu</a>"<span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(189,54,19)">SPNameQualifier=</span>"<a href="https://ualaska.cherwellondemand.com">https://ualaska.cherwellondemand.com</a>"<span class="gmail-s2" style="color:rgb(33,118,199)">></span><span class="gmail-s1" style="color:rgb(71,91,98)">ua\dabantz</span><span class="gmail-s2" style="color:rgb(33,118,199)"></saml2:NameID></span></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s1" style="color:rgb(71,91,98)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></span><span class="gmail-s2" style="color:rgb(33,118,199)"><SubjectConfirmation </span><span class="gmail-s4" style="color:rgb(189,54,19)">Method=</span>"urn:oasis:names:tc:SAML:2.0:cm:bearer"<span class="gmail-s2" style="color:rgb(33,118,199)">></span></p><p class="gmail-p1" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-s1" style="color:rgb(71,91,98)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></span><SubjectConfirmationData <span class="gmail-s4" style="color:rgb(189,54,19)">Address=</span><span class="gmail-s5" style="color:rgb(165,119,5)">"••••••"</span><span class="gmail-Apple-converted-space"> </span></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> <span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(189,54,19)">InResponseTo=</span>"_0a35fb42-82f2-44f4-b8d5-841eef7bb0e9"<span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> <span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(189,54,19)">NotOnOrAfter=</span>"2019-04-29T17:08:42.600Z"<span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p2" style="margin:0px;font:10px Menlo;color:rgb(165,119,5)"><span class="gmail-s2" style="color:rgb(33,118,199)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><span class="gmail-Apple-tab-span" style="white-space:pre"> </span> <span class="gmail-Apple-converted-space"> </span></span><span class="gmail-s4" style="color:rgb(189,54,19)">Recipient=</span>"<a href="https://ualaska.cherwellondemand.com/cherwellservice/Saml/Assertion.aspx">https://ualaska.cherwellondemand.com/cherwellservice/Saml/Assertion.aspx</a>"<span class="gmail-s2" style="color:rgb(33,118,199)">/></span></p><p class="gmail-p1" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)"><span class="gmail-s1" style="color:rgb(71,91,98)"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></span></SubjectConfirmation></p><p class="gmail-p1" style="margin:0px;font:10px Menlo;color:rgb(33,118,199)">
</p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(33,118,199)"></Subject></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">David Bantz</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">UA OIT IAM</span></p></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 29, 2019 at 6:03 AM Lohr, Donald <<a href="mailto:lohrda@jmu.edu">lohrda@jmu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
While doing some web searching over the weekend I found the
following url:<br>
<br>
<a class="gmail-m_3625545869671758459moz-txt-link-freetext" href="https://iam.alaska.edu/shib/wiki/Cherwell" target="_blank">https://iam.alaska.edu/shib/wiki/Cherwell</a><br>
<br>
Was this config based in Shib IdP 2.x? If I may, are you running
Shib IdP 3.x, if so what does your Shib IdP 3.x config look like for
Cherwell?<br>
<br>
We are running Shib IdP 3.3.3.<br>
<br>
Thanks,<br>
Don</div>
</blockquote></div></div>