05-09-2017 10:27 AM
Hi,
We're trying to setup Shibboleth Authentication with Nuxeo 6.0 and Renater as wayf. Our ldap's users are identified with their UID but we would like to allow abroad connexion with the way of the CRU (compte réseau universel). But CRU account use email adress as key. How could we configure shibboleth add-on to allow on one part authentication with UID (LDAP) and on the other part authentication with email (CRU accounts) ?
Thanks in advance
05-09-2017 12:45 PM
You can have a look at the sample configuration of ShibbolethAuthenticationService
You can define a uid mapping from shib attributes varying according to the idp of the user.
A configuration could be to map the uid for your idp and a default one using eppn or email.
05-10-2017 09:49 AM
Hi pibou Bouvret,
Thank you for your answer, i really appreciate !
Indeed, i've already tried many configurations but the only one that perform correctly is "default"
I've read here that i need to patch ShibbolethAuthenticationPlugin.java to obtain what i expected. (+ fieldMap.put("username", userId);)
In V6, code extract is: ` public UserIdentificationInfo handleRetrieveIdentity( HttpServletRequest httpRequest, HttpServletResponse httpResponse) { if (getService() == null) { return null; }
String userId = getService().getUserID(httpRequest);
if (userId == null || "".equals(userId)) {
return null;
}
Session userDir = null;
try {
UserManager userManager = Framework.getService(UserManager.class);
userDir = Framework.getService(DirectoryService.class).open(
userManager.getUserDirectoryName());
Map<String, Object> fieldMap = getService().getUserMetadata(
userManager.getUserIdField(), httpRequest);
DocumentModel entry = userDir.getEntry(userId);
if (entry == null) {
// patch RB :
fieldMap.put("username", userId);
// fin patch RB
userDir.createEntry(fieldMap);
} else {
entry.getDataModel(userManager.getUserSchemaName()).setMap(
fieldMap);
userDir.updateEntry(entry);
}
} catch (Exception e) {
log.error("Failed to get or create user entry", e);
} finally {
if (userDir != null) {
try {
userDir.close();
} catch (DirectoryException e) {
log.error("Error while closing directory session", e);
}
}
}
return new UserIdentificationInfo(userId, userId);
`
In 8.2 version, ShibbolethAuthenticationPlugin.java is quite different. Sadly i can't understand how it operate.
Even though i can't manage multiple keys in v 6.0, if i choose
If you can give me some advices ...
05-10-2017 11:01 AM
Don't you have the EPPN transmitted by the CRU IDP ? It should according to https
05-10-2017 11:05 AM
https
05-10-2017 11:34 AM
Bonjour Pibou,
05-10-2017 11:54 AM
According to the Renater docs, the EPPN is provided if it is required by your SP
05-11-2017 11:45 AM
Hi Pibou, merci,
Find what you came for
We want to make your experience in Hyland Connect as valuable as possible, so we put together some helpful links.