<div dir="ltr"><div><br></div>We're also not doing anything special for Bomgar with our standard persistent NameID. The only gotcha I ever recall encountering was when we were accidentally releasing duplicate attributes with different names but the same friendlyName. Bomgar really didn't like that. No one else seemed to have a problem with it. Nevertheless, I fixed it so the duplicate attributes weren't being released, and it started to work again.<div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div>-- </div><div>Paul Engle</div><div>IAM Architect</div><div>Identity & Access Management</div><div><a href="mailto:pengle@rice.edu" target="_blank">pengle@rice.edu</a> 713-348-4702</div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Oct 14, 2022 at 8:38 AM Herron, Joel D <<a href="mailto:herronj@uww.edu">herronj@uww.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-2184840723248899487">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="m_-7695401345745805149WordSection1">
<p class="MsoNormal">We are allowing their release of the persistent nameID which is just our standard persistent ID (a sha1 hash of a salted UUID). As well I’m releasing:<br>
uid, displayName, mail and groupMembership (for authorization in BT)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m doing nothing special in relying party or in their metadata, was a really easy setup from what I recall.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Hope that helps,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">--Joel<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;color:black">From:
</span></b><span style="font-size:12pt;color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of IAM David Bantz via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Thursday, October 13, 2022 at 2:40 PM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Cc: </b>IAM David Bantz <<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>><br>
<b>Subject: </b>Bomgar/BeyondTrust relying party?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><strong><span style="font-family:Calibri,sans-serif;color:black;background:rgb(255,229,229)">EXTERNAL EMAIL</span></strong><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Have you successfully configured Bomgar (BeyondTrust) for SSO via your Shibb IdP ?<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Bomgar (BeyondTrust) has a GUI for SAML SSO integration that is mostly clear and straightforward,<u></u><u></u></p>
<div>
<p class="MsoNormal">but seemingly appropriate SAML assertions trigger “Authentication Failed” message at the service<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">(with no further details).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Incoming SAML request specifies a nameid-format:persistent (not mentioned in the GUI) so<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I configured release of nameID based on uid (unscoped username) and ePPN (same username, @<a href="http://alaska.edu" target="_blank">alaska.edu</a>)<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">with the requested format. Neither alternative produced anything further than “Authentication Failed” at the service.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Support has so far been less than useless. Perhaps you know an additional unmentioned requirement or trick?<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">David St Pierre Bantz<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">U Alaska IAM<u></u><u></u></p>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div>