{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Please read and follow the ","type":"text"},{"text":"v5 SAML AuthN documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973"}}]},{"text":" first, before or along with using this example.","type":"text"}]},{"type":"paragraph","content":[{"text":"This documentation is not maintained by the development team and may not be entirely accurate or consistent with the software at any given time. It is a complement to the documentation, not a replacement for it.","type":"text"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"6"},"include":{"value":""},"outline":{"value":"false"},"indent":{"value":""},"style":{"value":"default"},"exclude":{"value":""},"type":{"value":"list"},"class":{"value":""},"printable":{"value":"true"}},"macroMetadata":{"macroId":{"value":"58968bc2-1058-4ba5-ba4e-7aa17c03b431"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"dfcf5858-c67f-4a91-89a5-16946eef1ab3"}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Overview ","type":"text"}]},{"type":"paragraph","content":[{"text":"The Shibboleth IdP can be a proxy to EntraID leveraging its features while keeping in alignment to R&E federation's multi-lateral trust model. The steps can be applied to any V5+ base install and are platform neutral. When done the IdP will be capable of being a full pass-through proxy with Attributes originating from EntraID as well as the ability to take advantage of MFA and REFEDS-MFA authentication contexts.","type":"text"}]},{"type":"paragraph","content":[{"text":"Expected Audience","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"The configuration steps assume some familiarity with the Shibboleth IdP, its layout, and being familiar with software installation and sustainment. This guide is intended to assist IAM implementors configuring Microsoft Entra ID as the primary identity provider (IdP) along with Shibboleth as the SAML proxy providing access to multilateral federation apps or services (e.g. CAF, eduGAIN or InCommon). ","type":"text"}]},{"type":"paragraph","content":[{"text":"Where to Install","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"This configuration can be applied to an IdP on-premises (on-prem) or in the cloud. The location of the IdP may be influenced by the location of your data. Unless all your data is kept in EntraID you will likely be implementing a hybrid approach for attributes from both EntraID and normal Shibboleth IdP attribute resolution.","type":"text"}]},{"type":"paragraph","content":[{"text":"Acknowledgements: Thanks to contributors from JISC, other US higher ed institutions, the Shibboleth team, and others for guidance and input on the material.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"IdP Proxying Concepts: Appearances and Perspectives","type":"text"}]},{"type":"paragraph","content":[{"text":"Proxying techniques are confusing at times and helpful to understand the perspectives:","type":"text"}]},{"type":"paragraph","content":[{"text":"EntraIDs:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Shibboleth IdP will look like a Relying Party to EntraID","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"It will be a ","type":"text"},{"text":"single","type":"text","marks":[{"type":"strong"}]},{"text":" non-Gallery App registered in the Enterprise Apps portal for Azure","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"means that all conditional access and policy rules are applied at an IdP-wide level, ","type":"text"},{"text":"NOT ","type":"text","marks":[{"type":"strong"}]},{"text":"per Shibboleth Relying Party.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"also means that applying rules for MFA ","type":"text"},{"text":"as controlled by EntraID","type":"text","marks":[{"type":"em"}]},{"text":" are for the entire IdP and NOT discrete Shibboleth Relying Parties.","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Relying Party (Service Provider) from the multi-lateral trust/R&E federation community:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"It will look like a fully functional multi-lateral capable IdP ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"It will not require any changes in behaviour to the SP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Attribute asserted over the wire are what the SP expects. i.e. attributes are NOT seen as 'claims' ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Users: ","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A user will sign into EntraID","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Shibboleth IdP as proxy will redirect as necessary","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The user will have two sessions:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"one with EntraID","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"one with the Shibboleth IdP","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Federation Operator:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The entity registered in the R&E federation is the Shibboleth IdP, built for and by the R&E community and should meet all technical requirements as does any other Shibboleth IdP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Alignment to any federation baseline expectations is not just software but also how it's operated and managed and is in the hands of the IdP operator like any other IdP. ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"IdP Proxying Concepts: What a Proxy Flow Looks Like","type":"text"}]},{"type":"paragraph","content":[{"text":"When the user initiates sign-on the following usually happens:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"An Authentication request arrives at Shibboleth IdP","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Shibboleth IdP observes it's configured for SAML sign on and redirects to an upstream IdP (EntraID). Settings for this are controlled in","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.properties ","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"authn/authn.properties","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User Authenticates or has an existing session at upstream IdP (EntraID)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The upstream IdP (EntraID) constructs a SAML Assertion with one or more attributes and is sent with the user to the Shibboleth IdP ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Shibboleth IdP receives the assertion and:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"verifies that the assertion arrives from an entity it trusts as configured in ","type":"text"},{"text":"metadata-providers.xml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"filters the assertion according to rules in ","type":"text"},{"text":"attribute-filter.xml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Extracts the real user as configured in ","type":"text"},{"text":"attribute-based subject c14n","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631602"}}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Looks through list of ","type":"text"},{"text":"AttributesToResolve","type":"text","marks":[{"type":"code"}]},{"text":" in the resolver, resolves each one.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Applies a idp admin configured regular expression to the EntraID name claim","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Resulting trusted ","type":"text"},{"text":"real","type":"text","marks":[{"type":"em"}]},{"text":" username is used as ","type":"text"},{"text":"$resolutionContext.principal","type":"text","marks":[{"type":"code"}]},{"text":" (eg. existing LDAP data connector, etc.) during \"standard\" attribute resolution process","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Implementing the Solution","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"paragraph","content":[{"text":"Be sure to have these assets in place and appropriate access to them before you start:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A working Shibboleth Identity Provider at V5 or above running somewhere.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"An active EntraID tenant that you have administrative control in","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ability in EntraID to create an enterprise Non-Gallery SAML App","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A suitable attribute available to both IdPs to use as a \"joining\" attribute used in local lookups if necessary.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Terms and Settings ","type":"text"}]},{"type":"paragraph","content":[{"text":"This document refers to some key settings and terms described here. For your installation have these on hand to speed up configuration:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Your original IdP EntityID:","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"https://idp.example.com/idp","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Your Upstream IdP EntityID which is EntraID Identifier:","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"https://sts.windows.net// (","type":"text","marks":[{"type":"code"}]},{"text":"Finding your tenantID","type":"text","marks":[{"type":"link","attrs":{"href":"https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant"}}]},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The Proxy Joining attribute","type":"text","marks":[{"type":"strong"}]},{"text":" common to both services:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SamAccountName","type":"text","marks":[{"type":"code"}]},{"text":" is often a good choice and appears as 'name' in claims.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"will exist as a 'scoped' username","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the scope being that of the domain used on-premises and is usually internet friendly (not something.local or something.int)","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Relying Party/Service","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Provider","type":"text","marks":[{"type":"strong"}]},{"text":" Microsoft will use \"Relying Party\" at times to mean \"Service Provider\"","type":"text"}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Steps and Tasks","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Step 1. Configuring Trust Between EntraID and the Shibboleth IdP","type":"text"}]},{"type":"paragraph","content":[{"text":"There are 3 main trust-related configurations to adjust:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Shibboleth IdP:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"to have the SPSSODescriptor present in its metadata for when metadata for the IdP is fetched by URL","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" to have a metadata entry for the EntraID IdP in its metadata providers' configuration","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In EntraID","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the EntraID trust to the Shibboleth IdP as a Relying Party","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Trust Task: 1. Update your IdP's metadata","type":"text"}]},{"type":"paragraph","content":[{"text":"As your IdP will need act as an SP, you'll need extra blocks in your entity's metadata.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update your existing ","type":"text"},{"text":"idp-metadata.xml","type":"text","marks":[{"type":"code"}]},{"text":" file to include a ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" block. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Copy the signing and encryption certificates from the IdP part of the metadata and replace the base URI used below as an example (","type":"text"},{"text":"https://idp.example.com/idp","type":"text","marks":[{"type":"code"}]},{"text":") with the base of your IdP.","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This SPSSODescriptor enriched metadata is used with your upstream IDP (EntraID), not in your R&E federation and not necessary to be published in the R&E fed.","type":"text"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n \n \n ...\n \n\n \n ...\n \n\n\n \n \n\n \n \n \n \n ...Signing Certificate from IdP...\n \n \n \n \n \n \n \n \n ...Encryption Certificate from IdP...\n \n \n \n \n\n \n\n\n","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Trust Task: 2. Register your IdP with EntraID","type":"text"}]},{"type":"paragraph","content":[{"text":"An EntraID Enterprise Application needs to be created of type 'Non-Gallery Application' and configured for SAML.","type":"text"}]},{"type":"paragraph","content":[{"text":"Steps to create the app:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"sign in to the EntraID Portal > choose Enterprise Applications > Create New Application > Non Gallery Application > Actually create one > select SAML Sign On > select SAML Sign On settings","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Once created edit the Basic SAML Configuration Section where you will use two things:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the EntityID: ","type":"text"},{"text":"https://idp.example.com/idp/shibboleth","type":"text","marks":[{"type":"code"}]},{"text":" (same as for your IdP )","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the Assertion Consumer Service (ACS) URL: ","type":"text"},{"text":"https://idp.example.com/idp/profile/Authn/SAML2/POST/SSO","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"Other items like Logout URL can also be provided but the Shibboleth side will not handle logout in this case, so this is best omitted.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":621,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1528,"id":"71ba444c-5883-4674-afce-7e6034188b2b","collection":"contentId-2783936889","type":"file","height":1712}}]},{"type":"paragraph","content":[{"text":"Keep this Relying Party editing environment open for the next step.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Trust Task: 3. Register the upstream IdP's metadata locally","type":"text"}]},{"type":"paragraph","content":[{"text":"Your Shibboleth IdP doesn't know of the EntraID IdP so you need to register it locally. This is handled just like any other metadata and can be included in your ","type":"text"},{"text":"metadata-providers.xml","type":"text","marks":[{"type":"em"}]},{"text":" as a new ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element. For example:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"","type":"text"}]},{"type":"paragraph","content":[{"text":"The file AzureAD-idp.xml must contain valid SAML 2. Metadata for your tenant's entity containing:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"an IDPSSODescriptor block containing a hand entered shibmd:scope element","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"an X509Descriptor element with use=signing","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"2 SingleSignOnService elements","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"1 SingleLogOut element (not really supported but will allow error responses to be returned to Azure)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"This can be most easily found and downloaded by clicking on ","type":"text"},{"text":"'Federation Metadata XML Download","type":"text","marks":[{"type":"strong"}]},{"text":"' in Section 3 of the EntraID Relying Party information, however it needs to be scrubbed a bit to produce a lean version of the metadata.","type":"text"}]},{"type":"paragraph","content":[{"text":"Hint: Those on mac or unix may find it convenient processing the file through ","type":"text"},{"text":"xmllint","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"--format downloadedfile.xml > downloadedfile-formated.xml","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"(xmllint","type":"text","marks":[{"type":"code"}]},{"text":" can be found in a package named ","type":"text"},{"text":"libxml2","type":"text","marks":[{"type":"code"}]},{"text":" on RedHat or ","type":"text"},{"text":"libxml2-utils","type":"text","marks":[{"type":"code"}]},{"text":" on Debian/Ubuntu.)","type":"text"}]},{"type":"paragraph","content":[{"text":"Hand-adjust the downloaded metadata to add both the XML NameSpace and a value for shibmd:Scope in the IDPSSODescriptor element:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add to the EntityDescriptor in your downloaded metadata: ","type":"text"},{"text":"xmlns:shibmd=\"urn:mace:shibboleth:metadata:1.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"add the Extensions element inside the IDPSSODescriptor element to align with the scope validation per the rule in ","type":"text"},{"text":"Proxy Task 2","type":"text","marks":[{"type":"strong"}]},{"text":" below:","type":"text"}]}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n your_scope_domain_here\n","type":"text"}]},{"type":"paragraph","content":[{"text":"When done, add an entry to ","type":"text"},{"text":"metadata-providers.xml.","type":"text","marks":[{"type":"em"}]},{"text":" If you fetch this entry elsewhere or by other means (e.g. curl or otherwise) ensure you know and understand its pedigree and don't blindly trust it without some diligence of some sort.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":60.0},"content":[{"type":"media","attrs":{"width":804,"id":"40243ed7-4321-4c8f-a297-b6e8f4ceab01","collection":"contentId-2783936889","type":"file","height":482}}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Note!","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"About certificates:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The certificate generated by EntraID is only 3 years in duration and is the trust between Azure and the Shibboleth Proxy only.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Expect EntraID to cease trust when it expires.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Also expect certificate rollover between EntraID and your IdP instance to be handled by the IdP admin team. ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"About the metadata download itself:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"There are no linefeeds between lines (so reformat e.g. with xmllint as shown above, if desired)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"It contains unnecessary elements that can be removed to reduce the size of the file:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"a signature embedded in the top of the file","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The section Fed:ClaimTypesOffered ","type":"text"}]}]}]}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Trust Task: 4. Configure EntraID Attribute Release to the Shibboleth IdP","type":"text"}]},{"type":"paragraph","content":[{"text":"While still in the edit mode of the Relying Party, configure the necessary attributes needed for the Shibboleth IdP operation.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For a pass-through proxy approach","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"All attributes originate from EntraID and must be released to this Relying Party for the Shibboleth IdP to marshall downstream","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For a hybrid proxy approach","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Technically the single attribute you want to use for user lookup is required.","type":"text"}]}]}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":782,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1560,"id":"83e50f07-b96a-4f10-a01b-86bb69059c97","collection":"contentId-2783936889","type":"file","height":426}}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"user.localuserprincipalname","type":"text","marks":[{"type":"textColor","attrs":{"color":"#292827"}},{"type":"strong"}]},{"text":" is the usual choice for the main user identifier but review your practices carefully. This identifier is ALWAYS in the realm of the EntraID tenant whereas user.userprincipalname may not be for guest users in the EntraID tenant and WILL NOT pass the shib:md scope in your metadata. ","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Step 2. Configure the IdP for Proxing Behaviour","type":"text"}]},{"type":"paragraph","content":[{"text":"The following changes are needed to adjust the IdP to proxying behaviour:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Changing the authentication flow to SAML authentication","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configuring which Entity to delegate to for the flow","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update attribute filter to allow incoming attributes to be ingested","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up attribute extraction through Subject Canonicalisation (c14n and resolver)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Proxy Task 1. Change the IdP authentication flow to SAML","type":"text"}]},{"type":"paragraph","content":[{"text":"There are three steps for this task that embody some of the existing ","type":"text"},{"text":"Authentication Configuration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085"}}]},{"text":" and ","type":"text"},{"text":" SAMLAuthnConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973"}}]},{"text":" guidance:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable the flow by updating","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"idp.authn.flows","type":"text","marks":[{"type":"code"}]},{"text":" in authn/","type":"text"},{"text":"authn.properties","type":"text","marks":[{"type":"em"}]},{"text":":","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"idp.authn.flows=SAML","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable to whom to delegate authentication by updating","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"idp.authn.SAML.proxyEntityID","type":"text","marks":[{"type":"code"}]},{"text":" in the same file ","type":"text"},{"text":"authn/","type":"text","marks":[{"type":"strong"}]},{"text":"authn.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":":","type":"text"},{"type":"hardBreak"}]},{"type":"codeBlock","content":[{"text":"idp.authn.SAML.proxyEntityID = https://sts.windows.net/00BC123-TENANTID-INCLUDING-TRAILING-SLASH/","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Proxy Task 2. Update Your Attribute Filter","type":"text"}]},{"type":"paragraph","content":[{"text":"The IdP will not ingest attributes from the EntraID Upstream IdP unless they're allowed","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"in","type":"text","marks":[{"type":"underline"},{"type":"strong"},{"type":"em"}]},{"text":" by a filter.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add a new ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" to permit trusted attributes to be handled.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"REPLACE sts_tenant_id with your identifier. ","type":"text"},{"text":"NOTE THE TRAILING SLASH TO BE INCLUDED","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"paragraph","content":[{"text":"Note: ","type":"text","marks":[{"type":"strong"}]},{"text":" There is a policy rule ScopeMatchesShibMDScope in effect on the attribute 'name' (known internally as azureName).","type":"text"}]},{"type":"paragraph","content":[{"text":"This will enforce that the ","type":"text"},{"text":"idp.scope","type":"text","marks":[{"type":"code"}]},{"text":" set in conf/idp.properties agrees with the EntraID field to avoid any oddities. If they disagree, this rule will fail-closed and not sign the user in.","type":"text"}]},{"type":"paragraph","content":[{"text":"Be sure the IdP metadata for the your EntraID IdP has the right scope for things to work smoothly","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Proxy Task 3. Enable IdP to Recognize EntraID Claims ","type":"text"}]},{"type":"paragraph","content":[{"text":"EntraID issues SAML assertions, however they are presented in an Azure/WS-Fed-centric naming convention (as \"claims\").","type":"text"}]},{"type":"paragraph","content":[{"text":"Our technique is to add in a new attribute mapping file that we can then use to parse the claims into internal attributes and in turn use them in the attribute resolver.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add","type":"text","marks":[{"type":"strong"}]},{"text":" a new file called in the IdP as ","type":"text"},{"text":"attributes/azureClaims.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" if it doesn't already exist. This file contains each of your attributes from EntraID that you want to use in the resolver.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The sample below is not exhaustive but has enough to get started on the claims file.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For azName we apply a scoped rule for safety considerations. The scope value MUST match the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension in the upstream IdP metadata.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The \"saml2.nameFormat\" rule property is ","type":"text"},{"text":"urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified","type":"text","marks":[{"type":"code"}]},{"text":" as the claims don't carry the proper format on them.","type":"text"}]}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n \n \n \n \n \n \n \n azureName\n SAML2ScopedStringTranscoder\n http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Name\n Azure UPN of an account expected to be scoped thus transcoded that way\n \n \n \n \n \n \n azureEmailaddress\n SAML2StringTranscoder\n http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Mail\n Azure emailaddress field of an account\n \n \n \n \n \n \n azureDisplayname\n SAML2StringTranscoder\n http://schemas.microsoft.com/identity/claims/displayname\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Mail\n Azure displayname field of an account\n \n \n \n \n \n \n azureGivenname\n SAML2StringTranscoder\n http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Given name\n Azure given name of an account\n \n \n \n \n \n \n azureSurname\n SAML2StringTranscoder\n http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Surname\n Azure surname of an account\n \n \n \n\n \n \n \n \n azureTenantid\n SAML2StringTranscoder\n http://schemas.microsoft.com/identity/claims/tenantid\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Tenant ID\n Azure tenantid\n \n \n \n \n \n \n azureObjectidentifier\n SAML2StringTranscoder\n http://schemas.microsoft.com/identity/claims/objectidentifier\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Object Identifier\n Azure object identifier of an account\n \n \n \n \n \n \n azureIdentityprovider\n SAML2StringTranscoder\n http://schemas.microsoft.com/identity/claims/identityprovider\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Identity Provider entityid\n Azure entityID of the tenant in Azure\n \n \n \n \n \n \n azureAuthnmethodsreferences\n SAML2StringTranscoder\n http://schemas.microsoft.com/claims/authnmethodsreferences\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Authnmethodsreferences\n Azure authentication method (password, modern auth? etc)\n \n \n \n \n \n \n azureGroups\n SAML2StringTranscoder\n http://schemas.microsoft.com/ws/2008/06/identity/claims/groups\n urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified\n Groups\n Azure Group Membership\n \n \n \n\n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"2. Update ","type":"text"},{"text":"attributes/default-rules.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"to include this new file as a reference by adding this line to it after the last import:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"","type":"text"}]},{"type":"paragraph","content":[{"text":"3. Update ","type":"text"},{"text":"attribute-resolver.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"to reveal our new attributes from EntraID by adding a new ","type":"text"},{"text":"DataConnector","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"Now that we have the the IdP able to interpret claims from EntraID, we need to turn our attention to using them for user canonicalization and for populating our attributes.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Proxy Task 4. Subject Canonicalisation","type":"text"}]},{"type":"paragraph","content":[{"text":"Much simplified, this step extracts the canonical (authoritative/normalized) username during a SAML proxying flow, and uses the subject-c14n.properties and subject-c14n.xml to guide the IdP on what to do.","type":"text"}]},{"type":"paragraph","content":[{"text":"The full reference is at ","type":"text"},{"text":"SAMLAuthnConfiguration#Attribute-Sourced-C14N-Example","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973#SAMLAuthnConfiguration-Attribute-Sourced-C14N-Example"}}]},{"text":" with specifics mentioned below for Azure/EntraID:","type":"text"}]},{"type":"paragraph","content":[{"text":"1. update ","type":"text"},{"text":"conf/c14n/subject-c14n.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":" with the following to guide what the IdP should extract and inputs to the process:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"idp.c14n.attribute.attributesToResolve = azureName,azureEmailaddress,azureDisplayname,azureGivenname,azureSurname,azureTenantid,azureObjectidentifier,azureIdentityprovider,azureAuthnmethodsreferences\n# and then select a principal name from\nidp.c14n.attribute.attributeSourceIds = azureName\n# Allows direct use of attributes via SAML proxy authn, bypasses resolver\nidp.c14n.attribute.resolveFromSubject = true\nidp.c14n.attribute.resolutionCondition = shibboleth.Conditions.FALSE\n#\n# Specific to this KB article, this is the regex used in the next step for subject-c14n.xml\nidp.c14.saml.proxy.regex.for.principal=^(.+)@yourdomain\\.edu$","type":"text"}]},{"type":"paragraph","content":[{"text":"2. Review and ensure the bean in ","type":"text"},{"text":"c14n/subject-c14n.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" has been uncommented (near the top of the file):","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":"3. Add to the same, ","type":"text"},{"text":"c14n/subject-c14n.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"at the bottom of the file just before the close bean teag.","type":"text"}]},{"type":"paragraph","content":[{"text":"This is to apply an Attribute Transformref:","type":"text"},{"text":"AttributeSourcedPostLoginC14NConfiguration#Reference","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505212#AttributeSourcedPostLoginC14NConfiguration-Reference"}}]},{"text":") to the idp.c14n.attribute.attributeSourceIds with the regex from idp.c14.saml.proxy.regex.for.principal:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\t \n \n ","type":"text"}]},{"type":"paragraph","content":[{"text":"At this point you should have a valid, locally understood username to pass into the \"normal\" resolver that already works, usually available as: ","type":"text"},{"text":"$resolutionContext.principal","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Proxy Task 5. Configuring Attribute pass-through and/or hybrid resolving","type":"text"}]},{"type":"paragraph","content":[{"text":"Attributes originating from EntraID are referenced in ","type":"text"},{"text":"attribute-resolver.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"through a ","type":"text"},{"text":"SubjectDataConnector","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199504610"}}]},{"text":" and then referencing them in the AttributeDefinition","type":"text"}]},{"type":"paragraph","content":[{"text":"Be sure to comment out the old definition of the names in the attribute-resolver.xml or you may get unexpected results.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\t\n \n \n\n\t\n \n \n\t\n\n \n \n\n\n \n \n\n\n \n \n\n\n \n \n\n","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Proxy Task 6. Handling REFEDS AuthnContext Requests (optional)","type":"text"}]},{"type":"paragraph","content":[{"text":"Supporting the ","type":"text"},{"text":"REFEDS-MFA AuthenticationContext","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.refeds.org/display/PRO/Introducing+the+REFEDS+MFA+Profile"}}]},{"text":" can be handled by instructing the Shibboleth IdP to transform inbound and outbound SAML2 Authentication Contexts during the proxying process.","type":"text"}]},{"type":"paragraph","content":[{"text":"To do this, add the following XML fragment for ","type":"text"},{"text":"shibboleth.PrincipalProxyRequestMappings","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"shibboleth.PrincipalProxyResponseMappings","type":"text","marks":[{"type":"code"}]},{"text":" in ","type":"text"},{"text":"authn/authn-comparison.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"This transformation will obligate an Azure/EntraID sign-on to require multiple authentication methods to satisfy the authenticationContext. More details can be found in ","type":"text"},{"text":"AuthenticationConfiguration#Advanced-Topics","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085#AuthenticationConfiguration-Advanced-Topics"}}]},{"text":". ","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t\n\t\t \n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\n\t\n\n\n\t\n\t\t \n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\n\t\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Update the support for the SAML authentication flow to understand the REFEDS MFA profile","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Since v4.1+ this is now controlled in the file ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"so it understands the REFEDS MFA profile by adding a ","type":"text"},{"text":"supportedPrinciples","type":"text","marks":[{"type":"em"}]},{"text":" property in the SAML section:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"authn/authn.properties update to support REFEDS MFA","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"idp.authn.SAML.supportedPrincipals = \\\n saml2/https://refeds.org/profile/mfa, \\\n saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol, \\\n saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \\\n saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \\\n saml1/urn:oasis:names:tc:SAML:1.0:am:password","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Proxy Task 7. Enabling eduPersonAffiliation from Entra ID/Azure (optional)","type":"text"}]},{"type":"paragraph","content":[{"text":"edupersonAffiliation","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://wiki.refeds.org/display/STAN/eduPerson+%28202208%29+v4.4.0#eduPerson(202208)v4.4.0-eduPersonAffiliation"}}]},{"text":" is used to populate ","type":"text"},{"text":"eduPersonScopedAffiliation","type":"text","marks":[{"type":"em"},{"type":"link","attrs":{"href":"https://wiki.refeds.org/display/STAN/eduPerson+2020-01#eduPerson202001-eduPersonScopedAffiliation"}}]},{"text":" which has the same constrained values but with the ‘@example.com’ scope chosen at the very first step of the IdP install process.","type":"text"}]},{"type":"paragraph","content":[{"text":"Both are part of the eduPerson schema and must contain values as prescribed in the ","type":"text"},{"text":"eduPerson","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.refeds.org/display/STAN/eduPerson+2020-01"}}]},{"text":" schema reference. Attribute values are typically multivalued, for example, ","type":"text"},{"text":"member@example.com","type":"text","marks":[{"type":"link","attrs":{"href":"mailto:member@yourdomain.ca"}}]},{"text":" along with any other standing within your institution.","type":"text"}]},{"type":"paragraph","content":[{"text":"eduPersonAffiliation is needed in support of the Research and Scholarship entity category, where hundreds of services may want to decide features offered to users who sign in based on their affiliation.","type":"text"}]},{"type":"paragraph","content":[{"text":"This guidance focuses on using the ","type":"text"},{"text":"Mapped AttributeDefinition","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199503134"}}]},{"text":" to map Azure Groups to these attribute values, however there are other techniques like:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"using ","type":"text"},{"text":"Scripted AttributeDefinition","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199503289"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"using Azure to have custom 'eduPersonAffiliation field' (not recommended as people need to be exclusively in one group to match - which is rare)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Prerequisites for this task","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Be sure to have the following info before starting this task:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ObjectID / GroupSIDs created in Azure portal for the following group mappings:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Employee","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Staff","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Faculty","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Student","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Member","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Enabling edupersonAffilation as a mapped claim for the Shibboleth IdP proxying Azure/Entra ID","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Applying the Proximity principle of “the closer to the data you are, the easier it is to handle”, we can use Entra ID's group data to map into ","type":"text"},{"text":"eduPersonAffiliation","type":"text","marks":[{"type":"em"}]},{"text":" which powers ","type":"text"},{"text":"eduPersonScopedAffiliation.","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"After the following steps are applied, ","type":"text"},{"text":"eduPersonAffiliation","type":"text","marks":[{"type":"em"}]},{"text":" mapped value will be set via the Entra ID claim for groups.","type":"text"}]},{"type":"paragraph","content":[{"text":"In Entra ID: [Enable Entra ID to release Azure groups and get the ObjectID / GroupSIDs]","type":"text","marks":[{"type":"strong"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update your attribute release in your enterprise app to release groups. Reference: ","type":"text"},{"text":"Configure group claims for applications by using Microsoft Entra ID","type":"text","marks":[{"type":"link","attrs":{"href":"https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Enterprise Application, Select -> Set up Single Sign-On with SAML, then Select -> Edit for Attributes and Claims.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select -> “Add a group claim”.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For Group Claims, Select -> “All Groups” and under “Source attribute”.","type":"text"}]},{"type":"paragraph","content":[{"text":"Next, if the Groups were created on Azure/Entra ID, then select -> “Group ID”, or else select “On Premises Group Identifier”.","type":"text"},{"type":"hardBreak"},{"text":"(Note: This source attributes only works for Groups synchronized from an on-premises Active Directory using Microsoft Entra Connect Sync 1.2.70.0 or above. ","type":"text"},{"text":"Learn More","type":"text","marks":[{"type":"link","attrs":{"href":"https://learn.microsoft.com/azure/active-directory/hybrid/how-to-upgrade-previous-version?WT.mc_id=Portal-Microsoft_AAD_IAM"}}]},{"text":").","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For each of the groups to be mapped into the IdP, collect the ","type":"text"},{"text":"ObjectID ","type":"text","marks":[{"type":"strong"}]},{"text":"/ ","type":"text"},{"text":"GroupSIDs","type":"text","marks":[{"type":"strong"}]},{"text":" for the following group mappings:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Employee","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Staff","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Faculty","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Student","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"member ","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Configuring the Shibboleth IdP","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Once the required data is being emitted by Entra ID, we need to update the Shibboleth IdP configuration to accept it and then repackage it. The steps in this section may look familiar from the tasks above","type":"text"}]},{"type":"paragraph","content":[{"text":"The Mapped AttributeDefinition performs a many-to-one mapping from source attributes values to a return value according to a series of mapping statements. If an input value matches no mapping rule, then a default can be provided. More information here: ","type":"text"},{"text":"Mapped AttributeDefinition","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199503134"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On the IdP, update ","type":"text"},{"text":"$idphome/conf/idp.properties","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":",","type":"text","marks":[{"type":"em"}]},{"text":" so the properties are abstracted from your configuration:","type":"text"}]},{"type":"codeBlock","content":[{"text":"idp.attribute.resolver.proxymapping.group.employee=recommended_to_be_set_to_a_group_sid\nidp.attribute.resolver.proxymapping.group.staff=e95deaef-e240-abcd-1234-suppressed\nidp.attribute.resolver.proxymapping.group.faculty=recommended_to_be_set_to_a_group_sid\nidp.attribute.resolver.proxymapping.group.student=recommended_to_be_set_to_a_group_sid\n# member is implied as presence in one of the above or explicitly as this group\nidp.attribute.resolver.proxymapping.group.member=recommended_to_be_set_to_a_group_sid","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Update the ","type":"text"},{"text":"$idphome/conf/attribute-resolver.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" to prepare the mapping by adding this attribute definition, and removing or commenting out the old one:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n \t\n \n \n employee\n %{idp.attribute.resolver.proxymapping.group.employee}\n \n \n staff\n %{idp.attribute.resolver.proxymapping.group.staff}\n \n \n faculty\n %{idp.attribute.resolver.proxymapping.group.faculty}\n \n \n student\n %{idp.attribute.resolver.proxymapping.group.student}\n \n \n member\n %{idp.attribute.resolver.proxymapping.group.employee}\n %{idp.attribute.resolver.proxymapping.group.staff}\n %{idp.attribute.resolver.proxymapping.group.faculty}\n %{idp.attribute.resolver.proxymapping.group.student}\n %{idp.attribute.resolver.proxymapping.group.member}\n \n","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the Shibboleth IdP to be able to decode Entra ID claims, make sure the ","type":"text"},{"text":"$","type":"text","marks":[{"type":"strong"}]},{"text":"idphome/conf/attributes/azureClaims.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" includes the new attribute ","type":"text"},{"text":"azureGroups","type":"text","marks":[{"type":"strong"}]},{"text":".(","type":"text"},{"text":"done in Proxy Task 3","type":"text","marks":[{"type":"em"}]},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the Shibboleth IdP to permit the pass through of attributes, confirm if the ","type":"text"},{"text":"$idphome/conf/attribute-resolver.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" includes the field ","type":"text"},{"text":"azureGroups","type":"text","marks":[{"type":"strong"}]},{"text":".(","type":"text"},{"text":"done in Proxy Task 5","type":"text","marks":[{"type":"em"}]},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For the Shibboleth IdP to accept the incoming claim, the ","type":"text"},{"text":"$idphome/conf/attribute-filter.xml","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":" has an extra ","type":"text"},{"text":"AttributeRule","type":"text","marks":[{"type":"em"}]},{"text":" to the ","type":"text"},{"text":"AttributeFilterPolicy","type":"text","marks":[{"type":"em"}]},{"text":" stanza which has ","type":"text"},{"text":"azureGroups.","type":"text","marks":[{"type":"strong"}]},{"text":"(","type":"text"},{"text":"done in Proxy Task 2","type":"text","marks":[{"type":"em"}]},{"text":")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To verify attributes are flowing as expected, use the IdP admin “hello” app at ","type":"text"},{"text":"https://idp.example.com/idp/profile/admin/hello","type":"text","marks":[{"type":"link","attrs":{"href":"https://your.idp.ca/idp/profile/admin/hello"}}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Testing","type":"text"}]},{"type":"paragraph","content":[{"text":"Restart your IdP for your changes before testing.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Consult the testing guidance in the ","type":"text"},{"text":"Supporting the REFEDS MFA Profile (V5+)#Testing","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/KB/pages/3503587329#SupportingtheREFEDSMFAProfile(V5+)-Testing"}}]},{"text":" section and use the ","type":"text"},{"text":"HelloWorldConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510241"}}]},{"text":" to do localized testing","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Avoid using ","type":"text"},{"text":"aacli","type":"text","marks":[{"type":"code"}]},{"text":" for SAML proxying testing as it will not accurately portray an upstream SAML sign-on and attribute assertion","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you are a member of a ","type":"text"},{"text":"local R&E federation","type":"text","marks":[{"type":"link","attrs":{"href":"https://technical.edugain.org/status"}}]},{"text":", they may have some MFA Service Providers that can be tested against as well.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Alternatively, standing up your own test SP with REFEDS-MFA AuthenticationContext is always an option.","type":"text"}]}]}]}],"version":1}