...
Service Now was somewhat of a straight forward implementation once we realized we had access to the script that generates the SAML 2.0 Authentication Request. Since we allow for anonymous SP authentication we modified two scripts on the in Service Now side to send requests that we liked and we were in businessare acceptable. Here are the diff's for the files we modified.
...
This modification was made to get rid of the AuthnContext which required username/password authentication, but since we are using RemoteUser for CAS this was asking to too much, so we I just removed it.
| Code Block | ||
|---|---|---|
| ||
jjv6@nomad:~/Desktop/service-now$ diff -cBr login.script login.script.orig
*** login.script 2011-11-15 09:29:19.938287229 -0500
--- login.script.orig 2011-11-15 09:30:21.798287235 -0500
***************
*** 124,131 ****
this.SAML2.createIssuer(elem);
this.SAML2.createNameIDPolicy(elem);
! //var rElem = this.SAML2.createRequestedAuthnContext(elem);
! //this.SAML2.createAuthnContextClassRef(rElem);
return this.SAML2.getEncodedSAMLRequest(elem);
},
--- 124,131 ----
this.SAML2.createIssuer(elem);
this.SAML2.createNameIDPolicy(elem);
! var rElem = this.SAML2.createRequestedAuthnContext(elem);
! this.SAML2.createAuthnContextClassRef(rElem);
return this.SAML2.getEncodedSAMLRequest(elem);
},
|
...
This modification removed the SPNameQualifier from the nameID requested. They send a value that is not the entityID and I could no make it work with shib, so I just removed it.
| Code Block | ||
|---|---|---|
| ||
jjv6@nomad:~/Desktop/service-now$ diff -cBr script.object.orig script.object *** script.object.orig 2011-11-15 09:31:45.318287245 -0500 --- script.object 2011-11-15 09:28:44.268287225 -0500 *************** *** 99,105 **** var nid = nb.buildObject(); nid.setValue(nameId); nid.setFormat(nameIdPolicy); ! nid.setSPNameQualifier(serviceURL); var nim = new NameIDMarshaller(); return nim.marshall(nid, parentElement); |
},
--- 99,105 ----
var nid = nb.buildObject();
nid.setValue(nameId);
nid.setFormat(nameIdPolicy);
! //nid.setSPNameQualifier(serviceURL);
var nim = new NameIDMarshaller();
return nim.marshall(nid, parentElement);
},
***************
*** 166,172 ****
var nameIdPolicy = nameIdPolicyBuilder.buildObject();
// insist on the emailAddress format to match with our user's email address
nameIdPolicy.setFormat(nameIdPolicyStr);
! nameIdPolicy.setSPNameQualifier(serviceURLStr);
nameIdPolicy.setAllowCreate(true);
var nidm = new NameIDPolicyMarshaller();
return nidm.marshall(nameIdPolicy, parentElement);
--- 166,172 ----
var nameIdPolicy = nameIdPolicyBuilder.buildObject();
// insist on the emailAddress format to match with our user's email address
nameIdPolicy.setFormat(nameIdPolicyStr);
! //nameIdPolicy.setSPNameQualifier(serviceURLStr);
nameIdPolicy.setAllowCreate(true);
var nidm = new NameIDPolicyMarshaller();
return nidm.marshall(nameIdPolicy, parentElement);
|