SAML / Guide: Integration info for vendors

Body

Objective

To provide information on what is needed to set up single sign-on with Miami

User

Anyone that would like to request single sign-on with Miami using SAML

Environment

10357: Shibboleth
- Shibboleth GUI

Guidelines

Request new setup

A new setup will require an exchange of information between the vendor and IT as well as configurations implemented in our environment
Share this article with the vendor
Submit a request for a new setup to Miami IT Services

About our environment

Our metadata: https://muidp.miamioh.edu/idp/shibboleth
Our EntityID: urn:mace:incommon:muohio.edu
InCommon: We are an InCommon member and consume the InCommon metadata
Supported NameID formats (In preferred order):
- urn:oasis:names:tc:SAML:2.0:nameid-format:transient (default)
- urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
- urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified (uses uid)
Testing accounts: We do not provide testing accounts, but are happy to test service upon request

Our SAML requirements

Your metadata (URL or file)
Your desired attributes
Your desired nameID format
Login URL for the service
Attribute Requester URL/URN (If different from EntityID)
SP or IdP-initiated login? (We strongly recommend SP-initiated)

Sample assertions

urn:oasis:names:tc:SAML:2.0:nameid-format:transient

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"

xmlns:xsd="http://www.w3.org/2001

/XMLSchema"

Destination="https://api.percipio.com/saml/login/callback?connection=saml-967888e6-bdca-404f-adb7-df0eb5c2ac37-1632836313481"

ID="_35034deb3abad0810d79c33139258ae2"

InResponseTo="_a00bdd6c8edbbd288345"

IssueInstant="2021-10-13T14:14:47.624Z"

Version="2.0"

>

<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:muohio.edu</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>

<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />

<ds:Reference URI="#_35034deb3abad0810d79c33139258ae2">

<ds:Transforms>

<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />

<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">

<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"

PrefixList="xsd"

/>

</ds:Transform>

</ds:Transforms>

<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />

<ds:DigestValue>SYFX9SsIKtZhMNF8v6bUhoqsYWt1H6Tt9Flp/Vo12kE=</ds:DigestValue>

</ds:Reference>

</ds:SignedInfo>

<ds:SignatureValue>Gm1GQ+gxwVEXEG2SU/1IXf9vgLvubrYsRMos0GF41WvOw4EpAJeEAvOc8bqNL5+OOh656vQ34/2yp+YSXGZH1+VHhK4RTBUUAfz948RHqVOSasyG2lVaPPPfHt45RS2aVmDewhrbOd0PDC8TSV+Eas53MalrqNIqaHzzJw5bDa0r1171PWhpb4RjkxXccKRivOD6TFGHeEsHSfRUFNiZ4rkw8T29q5VMyzx+1qa1ACv3E/kOg4QXDz7+6C8kSV5eLDMZuZ9KMIU1S2EjqIcSyGkKPfFW/O2yt86HoYwvFCzBbB1mPlou3+5KM68IqcVdpfz2jR1rI2tuY/Etf5SAsg==</ds:SignatureValue>

<ds:KeyInfo>

<ds:X509Data>

<ds:X509Certificate>MIIDLDCCAhSgAwIBAgIVAKw5joclkRM7v8BoI/l7FWUAWuZmMA0GCSqGSIb3DQEBBQUAMBsxGTAX

BgNVBAMTEG11aWRwLm11b2hpby5lZHUwHhcNMTEwOTA2MTgxNzM3WhcNMzEwOTA2MTgxNzM3WjAb

MRkwFwYDVQQDExBtdWlkcC5tdW9oaW8uZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC

AQEAqb1TAe1bFQ71cuQZz4gP91bTRr8OIr9VA6lAB9L3kO5KQYx5NUBkCbKsWky7M/dbW/+Pt9tj

6pkwIEr4GDO0un36EZPi3+1Gv0Wmc2WTGA8xQVCPoUP/bd7e5H+gRF7gla5Aj7zvejARFVnw5ajg

VvTTz5YZAp7Nmw+uJLHMb6IQf+m3xpKGM/tHqZDyhmKIFD18TopyiBLnRGHwKFwxx1SqqfAzkq2O

Or5LWb6M6D4FSF0jR0OGKzl6GNi05zvRm40P+nwydCIaC/XduoWodKuUl7UkX7JaltsaEVLbpXJB

ato9Uwyif1vqXMG4oKv0JqMv0I6uzA2J9wbLhQNgjQIDAQABo2cwZTBEBgNVHREEPTA7ghBtdWlk

cC5tdW9oaW8uZWR1hidodHRwczovL211aWRwLm11b2hpby5lZHUvaWRwL3NoaWJib2xldGgwHQYD

VR0OBBYEFHletfQytS1uCV3Q3wC3ObBMfcpPMA0GCSqGSIb3DQEBBQUAA4IBAQAZUdcZLnMUQpH0

1ZtHKveuPhbjFymh5NThn5Djx83uHXJV8duDEn9+DlEBmIkJefT5IIoRtHQZDeJVk5i5DDm6MJpa

N48/EVYIlsAnJqO1d6u+ccAIRSlWyqeQPTCJ59mEsv6Va9EEO106EPvcAmzkPjkOhl1Xv1kTYkhN

lUe+lD76xgvaizZqxQNOZSohGB6JKWVgpVmNKXrG70bPFoVDW9zHQ1QMn4zgrcdIXAh35hfJ3V11

hYNAxbEJR+a6JcLx6w8sYF4hKcNMez89uunCYYDYqK0Q9zukmasDWzcclzuqiJdWWMieNGYFgQOr

u5/17okAMls3dl2RmjoQgEsN</ds:X509Certificate>

</ds:X509Data>

</ds:KeyInfo>

</ds:Signature>

<saml2p:Status>

<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />

</saml2p:Status>

<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"

xmlns:xsd="http://www.w3.org/2001/XMLSchema"

ID="_5a1b333c00834c5fff4321d8d21ab238"

IssueInstant="2021-10-13T14:14:47.624Z"

Version="2.0"

>

<saml2:Issuer>urn:mace:incommon:muohio.edu</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>

<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />

<ds:Reference URI="#_5a1b333c00834c5fff4321d8d21ab238">

<ds:Transforms>

<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />

<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">

<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"

PrefixList="xsd"

/>

</ds:Transform>

</ds:Transforms>

<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />

<ds:DigestValue>ksC1ULNJukUG/aPnj6rdPwLBpoxV9RCDNlk88LbqQz4=</ds:DigestValue>

</ds:Reference>

</ds:SignedInfo>

<ds:SignatureValue>PDNc/HAmdN3/a6xrqhzRlYhSOUEqLERkSqv1hmIdW/aWTaorkQ46s+F1oSruzsFUt0SKgdQKTe9YXl48kOUHOWV18NAomRvBoOgTjCgQalCIErJWS2q3c5AolHouw9ttHzr7gXlhuUvCc/mRB1nFYsAwgxogalxgZaqCVha4irxnVy50Bn9HOkD/3xCT7jW61ZUxjvHD84Vvqok/Bhu7fx9svgC5rcHy+qARf9c5a6g+1L2k7OnN5k5DV+JagR+taijwSq+RFwBQLeHi79MgK6CJp0BvYSUi+lF93/7A9slDYO6GOJRaVKizzs44JvmcQKh1z0VKkyc3dbzErsnTBQ==</ds:SignatureValue>