Cbox ID
Shibboleth
Shibboleth
Single sign-on (SAML 2.0)
In the portal, choose Shibboleth under Enterprise SSO and Start with Shibboleth. Then, in Shibboleth:
- In conf/metadata-providers.xml, add a FileBackedHTTPMetadataProvider whose metadataURL is our metadata URL below, with a backingFile.
- In conf/attribute-filter.xml, add an AttributeFilterPolicy whose Requester rule names our entity ID and that releases mail (and the name attributes).
- In conf/saml-nameid.xml, add a SAML2AttributeSourcedGenerator for the emailAddress format sourced from mail.
- In conf/relying-party.xml, add a RelyingPartyByName override for our entity ID setting nameIDFormatPrecedence to the emailAddress format.
- Send us your IdP metadata (metadata/idp-metadata.xml as you publish it).
The values the portal shows
| Shibboleth field | Value |
|---|---|
| metadataURL (conf/metadata-providers.xml → <MetadataProvider xsi:type="FileBackedHTTPMetadataProvider">) | The portal's SP metadata URL (https://…/sso/saml/…/metadata) |
| value (conf/attribute-filter.xml → <PolicyRequirementRule xsi:type="Requester">) | The portal's entity ID (https://…/sso/saml/…) |
| nameIDFormatPrecedence (conf/relying-party.xml → SAML2.SSO) | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress |
What to bring back
Get idp-metadata.xml and paste the XML into the portal's Metadata URL or XML.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
Shibboleth's own guide: https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506865/FileBackedHTTPMetadataProvider.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.