<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Verdana",sans-serif;
color:#1F3864;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F3864">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">We are running into a bit of a problem with an implementation. Specifically the issue is an implementation of both “iGrad” and another product by the same company called “Enrich.” I'll explain in detail, but
has anyone implemented both of these in their Shib IDP and could aim us in the right direction?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">Issue 1: Shared Entity ID has conflicting ACS data in Metadata between inCommon and vendor hosted file<br>
Issue 2: CoBrand attribute resolution<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">At present they have not provided a single metadata that can work with both, instead the igrad application is published via incommon (under the above EntityID --
<a href="https://mdq.incommon.org/entities/https:%2F%2Fssotest.igrad.com%2FinCommonSSO" target="_blank" title="https://mdq.incommon.org/entities/https:%2f%2fssotest.igrad.com%2fincommonsso">
<span style="color:#1F3864;text-decoration:none">https://mdq.incommon.org/entities/https:%2F%2Fssotest.igrad.com%2FinCommonSSO</span></a>, but the second app, enrich, has a metadata published at
<a href="https://www.igrad.com/sso/metadata/enrich-test.xml" target="_blank" title="https://www.igrad.com/sso/metadata/enrich-test.xml">
<span style="color:#1F3864;text-decoration:none">https://www.igrad.com/sso/metadata/enrich-test.xml</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">Both use the same EntityID: <a href="https://ssotest.igrad.com/inCommonSSO" target="_blank" title="https://ssotest.igrad.com/incommonsso">
<span style="color:#1F3864;text-decoration:none">https://ssotest.igrad.com/inCommonSSO</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">ACS for InCommon: <a href="https://ssotest.igrad.com/Shibboleth.sso/SAML2/POST">
<span style="color:#1F3864;text-decoration:none">https://ssotest.igrad.com/Shibboleth.sso/SAML2/POST</span></a><br>
ACS for vendor hosted: <a href="https://ssotest.enrich.org/Shibboleth.sso/SLO/POST">
<span style="color:#1F3864;text-decoration:none">https://ssotest.enrich.org/Shibboleth.sso/SLO/POST</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">This is obviously their test environment, but similar issues exist for prod. We are resigned to combining their metadata for them, and this may provide a measure of successful SSO. (Odd for this to be an issue
with an Incommon published MD, but thats neither here nor there). <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">But the real issue comes that they have asked us to provide a 'cobrand' static attribute that varies in value based upon which application you are logging into. E.g., If user is visiting iGrad, release “IGRAD”
as the cobrand value. If user is visiting the Enrich website, it will value to “ENRICH.” It can be SP-Initiated or IDP-Initiated with a target back to the different vended hostnames.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">We are a bit stumped how to do this with both apps being under the same EntityID. Additionally it’s the same users between both SPs so there isn't a user based way to assign the cobrand attribute either, instead
it needs to be based upon the ACS or other portion of the SAML request.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">Any one got some suggestions/experience that could be helpful? The vendor continues to tell us they have many working integrations, forcing us to scratch out heads. I assume we’re missing something obvious.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F3864">Thanks,</span><span style="font-family:"Verdana",sans-serif;color:#1F3864"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">____________________________________________________________<br>
</span><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#002060">My working hours may not be your working hours. Please do not feel obligated to reply outside of your normal work schedule.</span><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Ken Koch</span></b><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> | Sr. Infrastructure Architect, Enterprise Engineering<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Washington University in St. Louis<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">4480 Clayton Ave., Campus Box 8218 | Clayton, MO 63110<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">w/c 314-935-8315 |
<a href="mailto:ken@wustl.edu"><span style="color:#0563C1">ken@wustl.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D"><a href="https://outlook.office365.com/owa/calendar/7e908a26784a493098ab15e67782e9b5@wustl.edu/45f20769f5284bf5afe324c68bd7ff0f831889786162711119/calendar.html"><span style="color:#0563C1">Need
to schedule a meeting? Check my availability here.</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<span style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p></o:p></span>
<p></p>
<div></div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended
recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone
or return mail.</span></p>
</body>
</html>