<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Helvetica;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:Helvetica"> </span><PolicyRequirementRule xsi:type="Requester" value="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php">https://whitmansandbox.bamboohr.com/saml/consume.php</a>" /><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This needs to be the EntityID of the RP, not the ACS endpoint.<span style="font-family:Helvetica"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Mike Osterman <ostermmg@whitman.edu><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Friday, July 26, 2019 at 5:37 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Trouble with SP (BambooHR) - have taken debugging as far as I can<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Thanks, Peter. I've done some more digging and changed some things, but still stuck. (see below)<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jul 26, 2019 at 3:19 AM Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">* Mike Osterman <<a href="mailto:ostermmg@whitman.edu" target="_blank">ostermmg@whitman.edu</a>> [2019-07-26 06:45]:<br>
> After some digging around, I found the documentation to do a Regex match in<br>
> the Requester URL:<br>
> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration" target="_blank">
https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration</a><br>
> <br>
> And came up with this:<br>
> <AttributeFilterPolicy id="BambooHR-SAML"><br>
> <PolicyRequirementRule xsi:type="RequesterRegex" regex="^<br>
> <a href="https://whitmansandbox.bamboohr.com/.*$" target="_blank">https://whitmansandbox.bamboohr.com/.*$</a>" /><br>
<br>
Regexes shouldn't be necessary. I'm guessing your tenant SP is only<br>
that: One (1) SP with one (1) unchanging entityID. Just providing the<br>
correct entityID there (cf. the metadata you added for that SP) should<br>
suffice?<br>
But either way it still doesn't match:<o:p></o:p></p>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You're right - I dug into the metadata file in $IDP_HOME/metadata/ and it advertises a URL without a wildcard:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <md:EntityDescriptor<br>
entityID="BambooHR-SAML"><br>
<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>
Location="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php">https://whitmansandbox.bamboohr.com/saml/consume.php</a>"<br>
index="0"<br>
isDefault="true"/><br>
</md:SPSSODescriptor><br>
</md:EntityDescriptor><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">So I've updated my attribute filter policy, and removed the entityID from the policy id attribute, just to make the logs easier to read:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <AttributeFilterPolicy id="bamboohr"><br>
<PolicyRequirementRule xsi:type="Requester" value="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php">https://whitmansandbox.bamboohr.com/saml/consume.php</a>" /><br>
<AttributeRule attributeID="mail"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule><br>
</AttributeFilterPolicy><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">> causing the<br>
> net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator<br>
> messages in lines 32-33 here: <o:p></o:p></p>
</blockquote>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">> <a href="https://gist.github.com/ostertoaster/3d322c8d2c9a48d9f8c3bb34cd7e12d0" target="_blank">
https://gist.github.com/ostertoaster/3d322c8d2c9a48d9f8c3bb34cd7e12d0</a><br>
<br>
Line 11 already states that the policy didn't apply, hence no<br>
attributes and no attribute-sourced NameID:<br>
<br>
> Attribute Filter Policy 'BambooHR-SAML' Policy is not active for this request<o:p></o:p></p>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">And yet still, same result - see line 5:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://gist.github.com/ostertoaster/740cb2174bafe3679a00aceb5e24cb72">https://gist.github.com/ostertoaster/740cb2174bafe3679a00aceb5e24cb72</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The only thing I didn't explicitly state is it only supports NameID (yeah, I know it sucks), but my understanding is I still need to release the 'mail' attribute so it can be released through NameID format. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">They also support Google Sign-In, but I *really* don't want to go that route, nor do I think our ISO wants to.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Mike<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>