shibboleth

OKTA integration issue with Shibboleth SP

安稳与你 提交于 2019-12-08 07:33:50
问题 I am doing a POC where I need to integrate the Shibboleth SP with OKTA idp provider.I have completed all below steps documented on OKTA official site for this integration. Install Shibboleth Service Provider 2.Configure the webserver to use Shibboleth 3.Configure Shibboleth to protect a specific folder Create an Okta SAML 2.0 Template application 4.Modify Shibboleth to use the metadata obtained from the Okta application 5.Modify the attribute-map.xml file within Shibboleth to set the

When using Shibboleth (v3) as SP , can I map the attribute value in attribute-map.xml?

旧巷老猫 提交于 2019-12-08 03:10:32
问题 OKTA is IdP and Shibboleth is SP in this setting. OKTA is passing attribute 'roles' something like idp_dev_SLAN_Power, idp_dev_SLAN_Admin, idp_dev_SLAN_account, etc I am wondering if I can strip 'idp_dev_SLAN_' out when it takes this attribute. Here is what I see in the current attribute-map.xml. <Attribute id="roles" name="roles" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" /> I feel like I can possibly do something with AttributeDecoder. any idea?? 回答1: I think you

How to provide SP metadata to TestShib IdP using passport-saml?

Deadly 提交于 2019-12-08 01:36:51
问题 I have a node.js script, using passport-saml, that simulates an SP. My goal is to connect it to this TestShib IdP but I get the following error: SAML 2 SSO profile is not configured for relying party . Based on what I read here, I know that I need to provide the SP metadata, but I do not know how. I know that passport-saml has the function: generateServiceProviderMetadata(decryptionCert) and I while I have the certificates required, I do not know how to make it all work. Also, I want to avoid

WARNING: unrecognized options: --disable-netaccessor-libcurl

孤街浪徒 提交于 2019-12-08 00:20:31
I am trying to install Xerces-C to my Shibboleth 2 SP following this guide: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxSourceBuild But when i run: ./configure --prefix=/opt/shibboleth-sp --disable-netaccessor-libcurl i get this warning: WARNING: unrecognized options: --disable-netaccessor-libcurl [...] config.status: creating src/xercesc/util/Xerces_autoconf_config.hpp config.status: src/xercesc/util/Xerces_autoconf_config.hpp is unchanged config.status: executing depfiles commands config.status: executing libtool commands config.status: executing libtool-rpath-patch

Forcing xml.etree to output “unused” namespaces

夙愿已清 提交于 2019-12-07 09:01:41
问题 I'm trying to create shibboleth configuration files using xml.etree in python, and I'm having problems with it omitting namespace assignments when it output the finished document. I'm pretty sure that it's the problem described in Outputting an “unused” XML namespace using ElementTree I declare them... namespaces = { 'resolver': 'urn:mace:shibboleth:2.0:resolver', 'xsi': 'http://www.w3.org/2001/XMLSchema-instance', 'pc': 'urn:mace:shibboleth:2.0:resolver:pc', 'ad': 'urn:mace:shibboleth:2.0

Single Sign on using Shibboleth

戏子无情 提交于 2019-12-06 04:32:19
I have to implement Single Sign On in my .NET(3.5) project using Shibboleth . Detailed requirement goes this way: 1) I have developped a web application using .NET (3.5) named "abc.com". 2) There are some third party applications which will be launched from "abc.com" 3) If I have logged in to "abc.com" and now if I launch any of the supported third party applications then it should not ask for login information again. From last few days I have been reading Shibboleth from https://spaces.internet2.edu/display/SHIB2/Home I have also installed Identity provider (IdP) and Service Provide (SP) from

Forward REMOTE_USER to tomcat via AJP (e.g. for shibboleth)

血红的双手。 提交于 2019-12-05 12:06:20
Today I just got stuck with the following problem: 1. I configured apache for basic authentication (require valid user); which worked. 2. I further configured apache to forward requests for some path (/idp in my case) to a tomcat servlet (shibboleth IDP). The result was, that the shibboleth IdP (ECP profile) told me there was no "REMOTE_USER" set (it's using the httpRequest.getRemoteUser() method to check this; it returned null). I tried a lot of things like SetEnv and RewriteRule stuff, but without success. The solution is quite simple, but rather hard to find... so I decided to post it here

SAML Request Attributes In AuthnRequest

自作多情 提交于 2019-12-05 09:51:26
I kind of understand how basic SAML authentication supposed to work: User request resource at SP SP sends auth request to IDP IDP authenticates user and sends back some userId SP sends attribute query to IDP for additional details with userId IDP sends back attributes SP gives user resource My issue is, can you any way bypass AttributeQuery. When I make a SAML 2.0 request to my testing Gluu/Shibboleth server, I get back givenName (firstname) and sn (lastname). Is there anyway I can request inum user id and email in just the AuthnRequest? My request is pretty simple: <samlp:AuthnRequest xmlns

Deployment on Tomcat: Constraint violation when resolving method “org.slf4j.impl.StaticLoggerBinder.getLoggerFactory()Lorg/slf4j/ILoggerFactory;”

老子叫甜甜 提交于 2019-12-05 01:43:11
问题 I'm deploying Shibboleth IdP 3.1.1 on Tomcat 8.0.22, but I receive this error: SEVERE [http-nio-8080-exec-13] org.apache.catalina.core.StandardContext.listenerStart Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener org.springframework.beans.BeanInstantiationException: Failed to instantiate [net.shibboleth.ext.spring.context.DeferPlaceholderFileSystemXmlWebApplicationContext]: Constructor threw exception; nested

Can I integrate Shibboleth SSO in my Java Webapp without using Apache and shibd?

三世轮回 提交于 2019-12-04 10:50:31
I'm working on a pure Java web application that uses an embedded Jetty and I want to integrate a Shibboleth login. To do this, I'm following switch.ch's guide for Shibboleth Service Provider Deployment , which states: The Shibboleth Service Provider consists of a daemon shibd running on all major operating systems and a web server module mod_shib which is natively supported by: Apache web servers (versions 1.3.x, 2.x) IIS (versions 6, 7 and 8) My question is, is there a way to integrate Shibboleth SSO in my Java web application without using an Apache web server or IIS running shibd? Maybe