Shibboleth3 as IdP – SAML

Step 1: Setup Shibboleth3 as Identity Provider

      • In conf/idp.properties, uncomment and set 'idp.encryption.optional' to true.
           eg. idp.encryption.optional = true
      • In conf/metadata-providers.xml, configure Service Provider like below.
        • <MetadataProvider xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata"
          id="miniOrangeInLineEntity" xsi:type="InlineMetadataProvider" sortKey="1">
          <samlmd:EntityDescriptor ID="entity" entityID="<SP-EntityID / Issuer from Service Provider Info tab in plugin.>"
            validUntil="2020-09-06T04:13:32Z">
            <samlmd:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
            protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
              <samlmd:NameIDFormat>
                urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
              </samlmd:NameIDFormat>
            <samlmd:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="<ACS (AssertionConsumerService) URL from Step1 of the plugin under Identity Provider Tab.>"
              index="1" />
            </samlmd:SPSSODescriptor>
            </samlmd:EntityDescriptor>
        </MetadataProvider>

      • In conf/saml-nameid.properties, uncomment and set default NameID as Email Address like this
        • idp.nameid.saml2.default=urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

      • In conf/saml-nameid-xml, search for shibboleth.SAML2NameIDGenerators. Uncomment the shibboleth.SAML2AttributeSourcedGenerator bean and comment all other ref beans.
        • <!-- SAML 2 NameID Generation -->
        <util:list id="shibboleth.SAML2NameIDGenerators">
          <!--<ref bean="shibboleth.SAML2TransientGenerator" /> -->
          <!-->ref bean="shibboleth.SAML2PersistentGenerator" /> -->
          <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
          p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
          p:attributeSourceIds="#{ {'email'} }" />
        </util:list>

      • Make sure you have defined AttributeDefinition in conf/attribute-resolver.xml.
        • <!-- Note: AttributeDefinitionid must be same as what you provided in attributeSourceIds in conf/saml-nameid.xml -->
        <resolver:AttributeDefinitionxsi:type="ad:Simple" id="email" sourceAttributeID="mail">
          <resolver:Dependency ref="ldapConnector" />
          <resolver:AttributeEncoderxsi:type="enc:SAML2String" name="email" friendlyName="email" />
        </resolver:AttributeDefinition >

        <resolver:DataConnector id="ldapConnector" xsi:type="dc:LDAPDirectory" ldapURL="%{idp.authn.LDAP.ldapURL}"
          baseDN="%{idp.authn.LDAP.baseDN}" principal="%{idp.authn.LDAP.bindDN}"
          principalCredential="%{idp.authn.LDAP.bindDNCredential}">
          <dc:FilterTemplate>
            <!-- Define you User Search Filter here -->
            <![CDATA[ (&(objectclass=*)(cn=$requestContext.principalName)) ]]>
          </dc:FilterTemplate>

          <dc:ReturnAttributes>*</dc:ReturnAttributes>
        </resolver:DataConnector>

      • Make sure you have AttributeFilterPolicy defined in conf/attribute-filter.xml.
        • <afp:AttributeFilterPolicy id="ldapAttributes">
        <afp:PolicyRequirementRulexsi:type="basic:ANY"/>
          <afp:AttributeRuleattributeID="email">
            <afp:PermitValueRulexsi:type="basic:ANY"/>
          </afp:AttributeRule>
        </afp:AttributeFilterPolicy>

      • Restart the Shibboleth server.
      • You need to configure these endpoints in the miniOrange plugin.
        • IDP Entity ID https://<your_domain>/idp/shibboleth
        Single Login URL https://<your_domain>/idp/profile/SAML2/Redirect/SSO
        Single Logout URL https://<your_domain>/idp/shibboleth
        X.509 Certificate The public key certificate of your Shibboleth server