<div dir="ltr">Steve, thank you! That did it! Everything's working on the Shibboleth IdP end of things now. The SP is another matter, but the Shib side is good.<div><br></div><div>I'm obviously going to need to brush up on my AttributeFilterPolicy syntax.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jul 26, 2019 at 8:28 PM Mak, Steve <<a href="mailto:makst@upenn.edu">makst@upenn.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-5525962701950740576WordSection1">
<p class="MsoNormal"><span style="font-family:Helvetica"> </span><PolicyRequirementRule xsi:type="Requester" value="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php" target="_blank">https://whitmansandbox.bamboohr.com/saml/consume.php</a>" /><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This needs to be the EntityID of the RP, not the ACS endpoint.<span style="font-family:Helvetica"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Mike Osterman <<a href="mailto:ostermmg@whitman.edu" target="_blank">ostermmg@whitman.edu</a>><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Friday, July 26, 2019 at 5:37 PM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>Re: Trouble with SP (BambooHR) - have taken debugging as far as I can<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">Thanks, Peter. I've done some more digging and changed some things, but still stuck. (see below)<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jul 26, 2019 at 3:19 AM Peter Schober <<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">* Mike Osterman <<a href="mailto:ostermmg@whitman.edu" target="_blank">ostermmg@whitman.edu</a>> [2019-07-26 06:45]:<br>
> After some digging around, I found the documentation to do a Regex match in<br>
> the Requester URL:<br>
> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration" target="_blank">
https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration</a><br>
> <br>
> And came up with this:<br>
> <AttributeFilterPolicy id="BambooHR-SAML"><br>
> <PolicyRequirementRule xsi:type="RequesterRegex" regex="^<br>
> <a href="https://whitmansandbox.bamboohr.com/.*$" target="_blank">https://whitmansandbox.bamboohr.com/.*$</a>" /><br>
<br>
Regexes shouldn't be necessary. I'm guessing your tenant SP is only<br>
that: One (1) SP with one (1) unchanging entityID. Just providing the<br>
correct entityID there (cf. the metadata you added for that SP) should<br>
suffice?<br>
But either way it still doesn't match:<u></u><u></u></p>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">You're right - I dug into the metadata file in $IDP_HOME/metadata/ and it advertises a URL without a wildcard:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <md:EntityDescriptor<br>
entityID="BambooHR-SAML"><br>
<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>
Location="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php" target="_blank">https://whitmansandbox.bamboohr.com/saml/consume.php</a>"<br>
index="0"<br>
isDefault="true"/><br>
</md:SPSSODescriptor><br>
</md:EntityDescriptor><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">So I've updated my attribute filter policy, and removed the entityID from the policy id attribute, just to make the logs easier to read:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeFilterPolicy id="bamboohr"><br>
<PolicyRequirementRule xsi:type="Requester" value="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php" target="_blank">https://whitmansandbox.bamboohr.com/saml/consume.php</a>" /><br>
<AttributeRule attributeID="mail"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule><br>
</AttributeFilterPolicy><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">> causing the<br>
> net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator<br>
> messages in lines 32-33 here: <u></u><u></u></p>
</blockquote>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">> <a href="https://gist.github.com/ostertoaster/3d322c8d2c9a48d9f8c3bb34cd7e12d0" target="_blank">
https://gist.github.com/ostertoaster/3d322c8d2c9a48d9f8c3bb34cd7e12d0</a><br>
<br>
Line 11 already states that the policy didn't apply, hence no<br>
attributes and no attribute-sourced NameID:<br>
<br>
> Attribute Filter Policy 'BambooHR-SAML' Policy is not active for this request<u></u><u></u></p>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">And yet still, same result - see line 5:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="https://gist.github.com/ostertoaster/740cb2174bafe3679a00aceb5e24cb72" target="_blank">https://gist.github.com/ostertoaster/740cb2174bafe3679a00aceb5e24cb72</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The only thing I didn't explicitly state is it only supports NameID (yeah, I know it sucks), but my understanding is I still need to release the 'mail' attribute so it can be released through NameID format. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">They also support Google Sign-In, but I *really* don't want to go that route, nor do I think our ISO wants to.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Mike<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>