<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Mark!!!!!<div class=""><br class=""></div><div class="">Thanks so much! That did it.</div><div class=""><br class=""></div><div class="">You are the best.</div><div class=""><br class=""></div><div class="">Mel</div><div class=""><br class=""><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="font-size: 14px;" class=""><font color="#007236" class=""><b class="">Melvin Lasky</b><br class="">Associate Director of Enterprise Architecture</font><br class=""><br class=""></span></div><span><img apple-inline="yes" id="B7C0ACD1-B28A-4B8F-90C6-8D58B48A8346" src="cid:30040C3B-58F3-41D0-91CF-B57E6B6E2FB7@manhattan.edu" class=""></span><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="font-size: 14px;" class=""><br class=""><br class=""><br class="">Riverdale, NY 10471<br class="">Phone: 718-862-7410<br class=""><a href="mailto:melvin.lasky@manhattan.edu" class="">melvin.lasky@manhattan.edu</a><br class="">www.manhattan.edu</span><br class=""><br class=""></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Jan 27, 2022, at 10:18 PM, Mark Boyce <<a href="mailto:Mark.Boyce@ucop.edu" class="">Mark.Boyce@ucop.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Duo requires that you set the NameID Format to “persistent” and send the Administrator’s email address …<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><bean parent="RelyingPartyByName" c:relyingPartyIds="….."><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <property name="profileConfigurations"><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <list><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" /><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </list><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </property><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </bean><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">You’ll need to set that up in saml-nameid.xml:<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <!-- SAML2 email NameID Generation for Duo --><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <bean parent="shibboleth.SAML2AttributeSourcedGenerator" p:omitQualifiers="true" p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> p:attributeSourceIds="#{ {'mail'} }"><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <property name="activationCondition"><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="…." /><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </property><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </bean><o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">m.<o:p class=""></o:p></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0in 0in;" class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span>users <<a href="mailto:users-bounces@shibboleth.net" style="color: blue; text-decoration: underline;" class="">users-bounces@shibboleth.net</a>><span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Melvin Lasky via users<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Thursday, January 27, 2022 5:48 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Shib Users <<a href="mailto:users@shibboleth.net" style="color: blue; text-decoration: underline;" class="">users@shibboleth.net</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Melvin Lasky <<a href="mailto:melvin.lasky@manhattan.edu" style="color: blue; text-decoration: underline;" class="">melvin.lasky@manhattan.edu</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Help with setting up Duo Admin Panel and Shibboleth<o:p class=""></o:p></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left"><tbody class=""><tr class=""><td style="background-color: rgb(187, 165, 85); padding: 5.25pt 5.5pt 5.25pt 1.5pt;" class=""></td><td width="100%" style="width: 1189.671875px; background-color: rgb(255, 229, 153); padding: 5.25pt 3.75pt 5.25pt 11.25pt;" class=""><div class=""><p class=""><b class=""><span style="font-family: Arial, sans-serif; color: rgb(33, 33, 33);" class="">CAUTION:</span></b><span style="font-family: Arial, sans-serif; color: rgb(33, 33, 33);" class=""><span class="Apple-converted-space"> </span>This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></p></div></td></tr></tbody></table><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hey All,<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I’ve been having a hard time setting up Duo Admin Panel with Shibboleth so if anyone can shed some light that be great.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I keep getting:<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Invalid response from SSO provider.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I tried unencrypted assertions with my <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <bean parent="RelyingPartyByName" c:relyingPartyIds=“xxxxx"><br class=""> <property name="profileConfigurations"><br class=""> <list><br class=""> <bean parent="SAML2.SSO" p:encryptAssertions="false" /><br class=""> </list><br class=""> </property><br class=""> </bean><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">(Where XXX is my Duo URL stuff)<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">But that didn’t work.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I saw this in there document (<a href="https://www.google.com/url?q=https://help.duo.com/s/article/4388?language%3Den_US&source=gmail-imap&ust=1643944735000000&usg=AOvVaw3pzzhF4v3wZL9eL2Lpjiap" style="color: blue; text-decoration: underline;" class="">https://help.duo.com/s/article/4388?language=en_US</a>)<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">• If the IdP is not signing both the assertion and the response. Duo requires that ADFS, Azure, Duo Access Gateway, Okta, and Shibboleth sign both the assertion and the response.<o:p class=""></o:p></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">• To resolve this issue when using one of these IdPs, configure the IdP to sign both the assertion and the response.<o:p class=""></o:p></div></div></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">——<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">How do I do that? I assume signing the assertion is just me taking out that relying party section but how do I sign the response?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks for your help!<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Any suggestions would be greatly appreciated!<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Mel<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><span style="font-size: 10.5pt; font-family: Helvetica, sans-serif; color: rgb(0, 114, 54);" class="">Melvin Lasky</span></b><span style="font-size: 10.5pt; font-family: Helvetica, sans-serif; color: rgb(0, 114, 54);" class=""><br class="">Associate Director of Enterprise Architecture</span><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><o:p class=""></o:p></span></p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span id="cid:image001.jpg@01D813C3.603B5040"><image001.jpg></span><o:p class=""></o:p></div><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 10.5pt; font-family: Helvetica, sans-serif;" class=""><br class=""><br class=""><br class="">Riverdale, NY 10471<br class="">Phone: 718-862-7410<br class=""><a href="mailto:melvin.lasky@manhattan.edu" style="color: blue; text-decoration: underline;" class="">melvin.lasky@manhattan.edu</a><br class=""><a href="https://www.google.com/url?q=http://www.manhattan.edu&source=gmail-imap&ust=1643944735000000&usg=AOvVaw3Dit4GmpPS1-edeZJMyTmO" style="color: blue; text-decoration: underline;" class="">www.manhattan.edu</a></span></p></div></div></div></div></div></div></blockquote></div><br class=""></div></body></html>