6

I didn't know the answer to your question off the top of my head, since after managing 5000+ user workstations and 30 servers without AD I kind of feel like any network larger than two workstations needs AD, ;) so I went and looked. The ADFS requirements at Technet say: Domain Requirements All AD FS servers must be a joined to an AD DS domain. ...


4

Okay, I got it myself. Basically you can add the requireSession attribute to the Host attribute, these are handled globally and the Path attributes are there to overwrite global behavior like disable shibboleth auth on exception/ requests. <RequestMapper type="Native"> <RequestMap applicationId="default"> <Host name="mydomain" ...


4

Switch.ch provides a repository with Shibboleth 2.5 for ubuntu 12.04 users, here: https://www.switch.ch/aai/docs/shibboleth/SWITCH/2.5/sp/deployment/?os=ubuntu You should be able to add their repository and download shibboleth 2.5 by doing the following: sudo apt-get remove libshibsp5 sudo curl -k -O http://pkg.switch.ch/switchaai/SWITCHaai-swdistrib.asc ...


3

We were having the same issue. Apparently Shibboleth cannot mix the formats of SAML 1 and SAML 2. You have to use them as follows (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute): SAML 1: urn:mace:shibboleth:1.0:attributeNamespace:uri (default) If you want to map an attribute with another format (but not a SAML 2 format), you ...


3

I have installed the latest JRE and linked to it in the the ENV variables properly Actually, it doesn't look like you've done that properly. The JAVA_HOME environment variable should not point to the java binary itself, but rather to the grandparent folder of the binary. In your case, it should point to c:\Program Files (x86)\Java\jre1.8.0_111\.


3

You got the identifier uri wrong. https://adfs.int.example.com/adfs/ls/" is the endpoint. Not the identifier. Identifier is http://adfs.int.example.com/adfs/services/trust" by default. Note its not https. But this can be changed by an admin. I don't know if you have. You can use get-adfsproperties cmdlet or the AD FS management console to view existing ...


3

Common reasons for this error include being unable to negotiate a mutual encryption algorithm, not having a public key loaded to encrypt the assertion to a particular consumer/SP, and not being able to load a required attribute in the document that is intended to be encrypted. It's most often the missing public key on the IdP that causes it, in my experience....


2

To check whether your "Transform SN" rule works as expected, install Fiddler. Then install this inspector so it is easier to read SAML messages. With these tools, you will be able to see what is sent from your ADFS server to your Shibboleth SP. Then you will know on which side the configuration error is. Edit: on screen #1, at the bottom of the window, ...


2

Yes the claims rule (displayed in two lines) is one 'statement'. It ends with the ';'. I.e. you add both lines to the same custom rule. For each issued (send) Claim (Attribute) with an object identifier uri, you need to add a custom rule (below the AD search rule). That is, if you want the "urn:oasis:names:tc:SAML:2.0:attrname-format:uri". If you just want ...


2

Did you follow this guide: AD FS 2.0 Step-by-Step Guide: Federation with Shibboleth 2 and the InCommon Federation? It's old but the principles are still valid. Hopefully, this will give you some clues.


2

What you are after is "where are you from less" URLS or WAYFLESS - this bypasses the discovery phase at the service provider, there are some built in features such as domain hint and geo ip that will bring the identity provider to the top of the list for the visiting clients based on what's in those parameters - but better off if you are an SP in a ...


2

I think it's mainly an Interoperability thing, that you can use ADFS as an IdP for Shibboleth and vice versa, that you can use identities from both "worlds", where ADFS is mainly used as the "gateway" to AD Authentication


2

Yes it is possible. I configured a single Shib Proxy some years ago. Here is all the documentation i wrote back then (its a setup on Solaris, some thing may be different on Linux). You will need a Server which holds the Application you want to protect and a Proxy Server with the Shibboleth stuff and some Proxy rules on it. Install Zone (or Linux Server) (...


2

I notice that your web.config files do not contain any shibboleth configuration, for instance the handler part : <add name="ShibbolethEndPoints" path="*.sso" verb="*" modules="IsapiModule" scriptProcessor="C:\opt\shibboleth-sp\lib64\shibboleth\isapi_shib.dll" resourceType="Unspecified" preCondition="bitness64" /> When I did my initial setup (...


2

I was facing the same issue on Centos-7 hosted in us-east-1. There is some discussion of build service mirroring problems on the repository config generation page. When you use that form to generate a shibboleth.repo configuration there's also a comment suggesting an another workaround: # If the mirrors stop working, change download to downloadcontent... I ...


2

I find in the shibboleth documentation those two attributes : signingAlg (URI) (defaults to the specifier for RSA-SHA1) An XML Signature signature algorithm specifier for signatures produced by the SP. digestAlg (URI) (defaults to the specifier for SHA1) So I add in my shibboleth2.xml configuration file in the ApplicationDefaults node : digestAlg="...


1

Try the following: <Location /> AuthType shibboleth require shibboleth Order allow,deny Allow from all </Location> <Location /secure> AuthType shibboleth ShibRequireSession On ShibUseHeaders On require valid-user </Location&...


1

The problem was solved by modifying shibboleth2.xml, changing this: <InProcess logger="native.logger"> <ISAPI normalizeRequest="true" safeHeaderNames="true"> <Site id="3" name="example.com"/> </ISAPI> </InProcess> to this: <InProcess logger="native.logger"> <ISAPI normalizeRequest="true" ...


1

From what I've been able to find, .NET Core doesn't work well with Shibboleth due to the way it uses IIS (as a proxy) and the fact that no managed code is available. Since Shibboleth runs as an ISAPI filter within IIS, and the .NET Core application is likely running within its own Kestrel web server, this doesn't work. The resource is not found because ...


1

You should simply do the following step: Get the URL where the IDP is listening for requests (you should find it in the metadata.xml of the IDP, more exactly in the field "Location" of element "SingleSignOnService"). The url is of the type: "schema://hostIDP/percorso". add an entry to your "hosts file" with the following couple: 127.0.0.1 hostIDP Setup your ...


1

1.Yes, have a look here https://wiki.shibboleth.net/confluence/display/IDP30/SPNEGOAuthnConfiguration. It's most likelly not version dependable as SPNEGO is a core part of Kerberos implementations. 2.On the wiki page above you have tutorials (like http://www.grolmsnet.de/kerbtut/) to test and understand it better. 3.It supports both windows and non windows,...


1

I don't know if you had find the solution, but I've just encountered the same situation, and I have a workaround : In your shibboleth2.xml file, change the "validate" parameter to "false", like this : <MetadataProvider type="XML" validate="false" file="/etc/shibboleth/FederationMetadata.xml"/> In my case, I'm able to be redirected on the login page ...


1

The IDP was configured to make a POST request to http://server.com/Shibboleth.sso/SAML/POST which maps to the SAML 1.1 protocol. As you can see from the assertion, the protocol is SAML 2.0. Therefore I had to change the ACS URL to http://server.com/Shibboleth.sso/SAML2/POST


1

SAML 2.0 Assertion schema tells that "Name" attribute is required. So you can't do what you want to do. <element name="Attribute" type="saml:AttributeType"/> <complexType name="AttributeType"> <sequence> <element ref="saml:AttributeValue" minOccurs="0" maxOccurs="unbounded"/> </sequence> <attribute name=...


1

There are really too many questions here! I would like to address the first one: generate the shibboleth SP metadata. You can use the tool: shib_metagen (in Debian it is in the shibboleth-sp2-utilspackage). In the shibboleth2.xml you specify where the federation metadata are. If you plan to let the SP download it from IdP, you need to check the ADFS ...


1

Port 8443 used in a special way: it has idp certificate associated with that port (which is usually a self-signed one). At the same time port 443 uses a well known certificate.


1

Confirm what version your apt repository has by running the following: apt-get update apt-cache show packagename


1

It looks like the shibboleth SP code is only written in C++ at the moment, with the apache module, an IIS module and NSAPI module acting as an interface to the shibd. Any way you look at it seems like you would need to implement a fair chunk of the existing code in java as I could find no existing libraries that do this job specifically. There is an opensaml-...


1

Yes, it's possible. Install and configure the nginx-http-shibboleth module for nginx, which provides the ability for nginx to understand the parts of the FastCGI authorizer spec which nginx can support; enough for Shibboleth authentication to succeed. Your installation will require FastCGI build of the Shibboleth Service Provider (SP) and appropriate ...


Only top voted, non community-wiki answers of a minimum length are eligible