Changes between Version 7 and Version 8 of BBCShibIntegration

Timestamp:

05/30/13 14:36:31 (12 years ago)

Author:

dabantz@…

Comment:

--

BBCShibIntegration

@@ -37 +37 @@
 
 
-(2.1) Add descriptors and certificates for BBC services into the metadata used by your IdP. Your IdP will be configured to consume metadata from one or more files. Add EntityDescriptor elements - including the entityIDs from step 1 and a certificate for each of the BBC services to be integrated to one of these files (order in which EntityDescriptors are listed or read is immaterial). As of this writing, the certificate itself is not actually used, so any certificate will do! Even though not actively used, a certificate must be present. The entityID must exactly match the entityID from step 1.
-example (a more complete example is in the appendix):
+(2.1) Add descriptors and certificates for BBC services into the metadata used by your IdP. Your IdP will be configured to consume metadata from one or more files. Add EntityDescriptor elements - including the entityIDs from step 1 and a certificate for each of the BBC services to be integrated to one of these files (order in which EntityDescriptors are listed or read is immaterial). As of this writing, the certificate itself is not actually used, so any certificate will do! Even though not actively used, a certificate must be present. The entityID must exactly match the entityID from step 1.[[BR]]
+
+''example (a more complete example is in the appendix)'':
+{{{
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+entityID="https://ssostg.blackboardconnect.com/SAML/Connect/
+B46C75BF139144349190F775C38F05A9">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:
+2.0:protocol">
+    <md:KeyDescriptor>
+      <ds:KeyInfo>
+        <ds:X509Data>
+          <ds:X509Certificate>
+MIIC3zCCAcegAwIBAgIJAJ21e7iR+TNiMA0GCSqGSIb3DQEBBQUAMBMxETAPBgNV
+H9uAnnFzNljGLT/EFIy2zDT/lCYetRT5kEthGjc1j4/9XfB85o75isrYcDAMdxrz
+...
+POST"
+Location="https://ssostg.blackboardconnect.com/SAML/Connect/
+B46C75BF139144349190F775C38F05A9" index="1"/>
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>
+}}}
+(2.2) Add "profile" data for BBC service(s) into relying-party.xml configuration file. [[BR]]
+''example fragment of relying-party.xml to support BBC services:
+''
+{{{
+<!-- BlackBoard Connect Staging -->
+    <RelyingParty id="https://ssostg.blackboardconnect.com/SAML/Connect/
+B46C75BF139144349190F775C38F05A9"
+          provider="urn:mace:incommon:alaska.edu"
+          defaultAuthenticationMethod="urn:oasis:names:tc:SAML:
+2.0:ac:classes:PasswordProtectedTransport"
+          defaultSigningCredentialRef="IdPCredential">
+  </ds:X509Certificate>
+</ds:X509Data>
+  </ds:KeyInfo>
+</md:KeyDescriptor>
+<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-
+<ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
+encryptAssertions="never" encryptNameIds="never" />
+    </RelyingParty>
+  <!-- BlackBoard Connect Sender Portal -->
+    <RelyingParty id="https://sso.blackboardconnect.com/SAML/Connect/
+6F0CEAB5A3704F84A767DFA3CC6CEBF7"
+          provider="urn:mace:incommon:alaska.edu"
+          defaultAuthenticationMethod="urn:oasis:names:tc:SAML:
+2.0:ac:classes:PasswordProtectedTransport"
+          defaultSigningCredentialRef="IdPCredential">
+        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
+encryptAssertions="never" encryptNameIds="never" />
+    </RelyingParty>
+  <!-- BlackBoard Connect Recipient Portal -->
+    <RelyingParty id="https://sso.blackboardconnect.com/SAML/Portal/
+7B9070E4D2DE4195A8B530EE72266AB0"
+          provider="urn:mace:incommon:alaska.edu"
+          defaultAuthenticationMethod="urn:oasis:names:tc:SAML:
+2.0:ac:classes:PasswordProtectedTransport"
+          defaultSigningCredentialRef="IdPCredential">
+        <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
+encryptAssertions="never" encryptNameIds="never" />
+}}}
+(2.3) Define and encode attributes needed by BBC in attribute-resolver.xml configuration file. You will need to understand what attributes are required for your customized implementation of BBC service(s) and how to obtain that data from the data sources available to your IdP. Our implementation specified, for each user:
+first name, last name, unique "!RefCode," and a logout URL. The example below assumes the name and unique identifier are available in an Active Directory and that the IdP and Active Directory have been configured to enable the IdP to retrieve that data from AD. The logout URL is the same for all users; it relies on a static data connector.
+BBC required that these attributes be passed with particular attribute names in the SAML assertion (different from the names commonly used in our Directores), so this fragment also associates those specific attribute names.
+
+
+''example fragments of attribute-resolver.xml to support BBC'':
+{{{
+<!-- RefCode is the Banner ID# released with attribute name required by Blackboard
+Connect   -->
+<!-- Sourced from UA Domain AD attribute uaIdentifier -->
+     <resolver:AttributeDefinition id="ContactRefCode" xsi:type="Simple"
+xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="uaIdentifier">
+     <resolver:Dependency ref="uaADLDAP" />
+     <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:
+2.0:attribute:encoder" name="urn:mace:alaska.edu:attributes:ContactRefCode"
+friendlyName="ContactRefCode"/>
+     </resolver:AttributeDefinition>
+<!-- DATA CONNECTOR STATIC LogoutURL for BBC -->
+  <resolver:DataConnector id="staticValueAttributes" xsi:type="Static"
+xmlns="urn:mace:shibboleth:2.0:resolver:dc">
+        <Attribute id="LogoutURL">
+           <Value>https://www.alaska.edu/uaalerts/</Value>
+        </Attribute>
+</resolver:DataConnector>
+<!-- ATTRIBUTE DEF LogoutURL uses staticValueAttributes data connector -->
+  <resolver:AttributeDefinition xsi:type="ad:Simple" id="LogoutURL">
+       <resolver:Dependency ref="staticValueAttributes" />
+       <resolver:AttributeEncoder xsi:type="enc:SAML2String"
+xmlns="urn:mace:shibboleth:2.0:resolver:ad" name="https://iam.alaska.edu/trac/wiki/
+IamUaArp" friendlyName="LogoutURL" />
+   </resolver:AttributeDefinition>
+<!-- BBC-named attributes: FirstName is givenName ; LastName is sn -->
+     <resolver:AttributeDefinition id="FirstName" xsi:type="Simple"
+xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="givenName">
+     <resolver:Dependency ref="uaADLDAP" />
+     <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:
+2.0:attribute:encoder" name="urn:oid:2.5.4.42" friendlyName="FirstName"/>
+     </resolver:AttributeDefinition>
+     <resolver:AttributeDefinition id="LastName" xsi:type="Simple"
+xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="sn">
+     <resolver:Dependency ref="uaADLDAP" />
+     <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:
+2.0:attribute:encoder" name="urn:oid:2.5.4.4" friendlyName="LastName"/>
+}}}
+
+(2.4) Configure policies to release appropriate attributes to BBC service(s). Configure the specific named attributes are released to the entityIDs of BBC service(s) in the attribute-filter.xml configuration file.
+
+
+''example attribute release policy for BBC'':
+{{{
+<AttributeFilterPolicy id="releaseToBBConnect">
+<PolicyRequirementRule xsi:type="basic:OR">
+    <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://
+sso.blackboardconnect.com/SAML/Portal/E0D069C2563D4D63A14CBB95D6845C25" />
+    <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://
+sso.blackboardconnect.com/SAML/Connect/9F95200F70EB4E8F844320653CCD97A8" />
+    <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://
+ssostg.blackboardconnect.com/SAML/Connect/B46C75BF139144349190F775C38F05A9" />
+</PolicyRequirementRule>
+   <AttributeRule attributeID="FirstName">
+        <PermitValueRule xsi:type="basic:ANY" />
+    </AttributeRule>
+    <AttributeRule attributeID="LastName">
+        <PermitValueRule xsi:type="basic:ANY" />
+    </AttributeRule>
+    <AttributeRule attributeID="ContactRefCode">
+        <PermitValueRule xsi:type="basic:ANY" />
+    </AttributeRule>
+    <AttributeRule attributeID="LogoutURL">
+        <PermitValueRule xsi:type="basic:ANY" />
+    </AttributeRule>
+</AttributeFilterPolicy>
+}}}
+=== (3) Configure unsolicited SSO for BBC ===
+
+BBC uses "unsolicited" or "IdP initiated" SSO. That means that, rather than the normal workflow of responding to a request from the SP that redirects the user's browser to the IdP for authentication and attributes, BBC requires us to send a SAML assertion with user authentication and required attributes without BBC having initiated that request. This is accomplished in the Shibboleth IdP by setting up a URL that invokes a profile (or "end point") specifically for unsolicited SSO ("idp/profile.SAML2/Unsolicited/SSO") and includes the (encoded) relying party entity id above. While it is possible to enter that link directly into a browser address bar, you will want to embed that long URL behind a button or text link on a web page you own. When the user clicks on the link, that initiates the request to your IdP to contact the BBC service. Additional information on
+unsolicited SSO with Shib
+boleth is at Shibboleth wiki IdPUnsolicitedSSO.
+
+
+(3.1) Your IdP must be able to accept unsolicited requests to a specific end point at the IdP. If your IdP configuration files were installed from Shibboleth 2.3.0 or later, the profile should already be there, but it's worth checking the configuration files and adding the following if not already present:
+The unsolicited or idp-initiated profile handler should be in handler.xml:
+{{{
+<ProfileHandler xsi:type="SAML2SSO"
+    inboundBinding="urn:mace:shibboleth:2.0:profiles:AuthnRequest"
+    outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
+                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
+                                urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
+  <RequestPath>/SAML2/Unsolicited/SSO</RequestPath>
+</ProfileHandler>
+}}}
+Also needed is the message decoder in internal.xml:
+{{{
+<entry>
+  <key>
+    <value>urn:mace:shibboleth:2.0:profiles:AuthnRequest</value>
+  </key>
+  <bean id="shibboleth.UnsolicitedSSODecoder"
+        class="edu.internet2.middleware.shibboleth.idp.profile.saml2.UnsolicitedSSODecoder">
+    <constructor-arg ref="shibboleth.IdGenerator"/>
+  </bean>
+</entry>
+}}}
+(3.2) Determine the URL that triggers the IdP-initiated SSO session with BBC. Recall that we have to forge the request to the IdP rather than the SP re-directing the user's browser. That's done with a link to your IdP that references the Unsolicited SSO profile and includes the subsequent BBC entityID to which the user's browser will be re- directed upon successful authentication by the IdP. Of course you will substitute your own !IdPs location for idp.alaska.edu and the entityIDs for BBC from step 1 (suitably encoded as here).
+''
+examples of URLs for SSO to BBC using the entityIDs from step 1:''
+
+Staging service:
+{{{
+https://idp.alaska.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2F ssostg.blackboardconnect.com%2FSAML%2FConnect%2FB46C75BF139144349190F775C38F05A9
+}}}
+Recipient Portal:
+{{{
+https://idp.alaska.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2F sso.blackboardconnect.com%2FSAML%2FPortal%2FE0D069C2563D4D63A14CBB95D6845C25
+}}}
+Sender Portal:
+{{{
+https://idp.alaska.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fsso.blackboardconnect.com%2FSAML%2FConnect%2F9F95200F70EB4E8F844320653CCD97A8
+}}}
+
+(3.3) You can test the integration by directly pasting those URLs into a browser, but you will want to have users click on a link on a web site you manage. That's your last task - to set up a web page with a description of the service and a button or text link behind which is one of the URLs for unsolicited SSO to BBC from (3.2).