By: Vreixo Luis Gonzalez Caneda user 26 Apr 2021 at 10:30 a.m. CDT

12 Responses
Vreixo Luis Gonzalez Caneda gravatar
Hi, I'm trying to configure O365 integration following this document https://gluu.org/docs/gluu-server/4.2/integration/saas/office/ and already tried all proposed solutions that I have found in the forum but still having this issue: "urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy". Also tried from documentation of Shibboleth which differs a bit but no luck either https://wiki.shibboleth.net/confluence/display/KB/Office+365. Files that I'm sharing are just from the Gluu steps. Installation is done via docker using pygluu-compose, I was able to do all changes except in "gluu-ldap.properties" were "binaryAttributes=objectGUID,objectguid" is being overwritten with "binaryAttributes=objectGUID" when I'm restarting the containers. I have uploaded templates from Gluu Github because they were not appearing in my installation to "/opt/gluu/jetty/identity/conf/shibboleth3/idp" for oxtrust container and after activating JCA I'm properly seeing my modifications on templates appearing in "/opt/shibboleth-idp/conf" oxshibboleth container for files "attribute-resolver.xml" and "saml-nameid.xml". Files are attached bellow for templates and generated files. Regarding custom attributes I'm attaching captures of how they are added to the interface, and the custom attributes file and "gluu-ldap.properties". I'm also attaching logs of shibboleth-process.log from start to first authentication. All is in this shared folder: https://www.dropbox.com/sh/1tguxsu75o5722r/AAAIhHrssYTB0WC84Ktc6W_Pa?dl=0 Thank you very much for your help, Vreixo Gonzalez - Whispeak

By Michael Schwartz staff 26 Apr 2021 at 2:41 p.m. CDT

Michael Schwartz gravatar
@Aliaksandr.Samuseu, Whispeak is one of our new partners. Could give them some pointers on this integration?

By Aliaksandr Samuseu staff 26 Apr 2021 at 2:52 p.m. CDT

Aliaksandr Samuseu gravatar
Hi. Just one suggestion, before we'll dive into the main issue - could you please create a separate ticket for Cache Refresh? I'll pick it up right away. It just makes much more difficult to sort out one issue from another, when ticket covers several of them.

By Aliaksandr Samuseu staff 26 Apr 2021 at 6 p.m. CDT

Aliaksandr Samuseu gravatar
One question, about this part: >Files that I'm sharing are just from the Gluu steps. Installation is done via docker using pygluu-compose, I was able to do all changes except in "gluu-ldap.properties" were "binaryAttributes=objectGUID,objectguid" is being overwritten with "binaryAttributes=objectGUID" when I'm restarting the containers You're talking about regular standalone Gluu Server, right? Not a cluster, neither a Docker or K8S based setup? It's just you mentioning "containers" in plural confuses me a bit (I'm thinking of how I can quickly reproduce your issue).

By Vreixo Luis Gonzalez Caneda user 27 Apr 2021 at 1:29 a.m. CDT

Vreixo Luis Gonzalez Caneda gravatar
Hi, Than thank you all for your fast answers. Installation is performed via pygluu-compose so on docket with multiple containers: oxtrust, oxauth and shibboleth for the main Gluu services. I have followed this link instructions https://gluu.org/docs/gluu-server/4.2/installation-guide/install-docker/. I have included svc files with the customizations made for oxtrust and oxshibbolrth in the shared folder. Sure, as it with the same integration I was including cache refresh issues but I'll open a new ticket for that. Not as much as a priority that part for now. regards

By Vreixo Luis Gonzalez Caneda user 29 Apr 2021 at 11:10 a.m. CDT

Vreixo Luis Gonzalez Caneda gravatar
Hi, I have created this other ticked for cache-refresh issues and removed info from this one to have the issue more clear: https://support.gluu.org/single-sign-on/9606/cache-refrest-not-importing-users/ We have continued to review and try with different configs but we did not arrive to have the NameIdPolicy working. Do you had the opportunity to take a look to our configs? Do you know what might be not working in our scenario? Thanks in advance

By Aliaksandr Samuseu staff 29 Apr 2021 at 12:54 p.m. CDT

Aliaksandr Samuseu gravatar
Hi, Vreixo. Sorry for the delayed answer. > Do you had the opportunity to take a look to our configs? Do you know what might be not working in our scenario? Yes, I checked them. I'm trying to reproduce the issue locally as of now. The difficulty is that I don't have access to O365 at hand right now, so need to improvise. As it seems to be a "wrong nameid" kind of error thrown right away, I think I'll be able to, with some request replaying magic. But if you have some time, that would also help to have a HAR file of your failing flow at hand. You can use steps listed [here](https://www.inflectra.com/support/knowledgebase/kb254.aspx) - please use Firefox for that task, Chrome's HARs are flawed. Also don't forget to set "Persist log" and "Disable cache" checkboxes in the console to save everything, not just the recently loaded page. I took over your other ticket, as well.

By Vreixo Luis Gonzalez Caneda user 29 Apr 2021 at 1:58 p.m. CDT

Vreixo Luis Gonzalez Caneda gravatar
Hi Aliaksandr, Our tests are performed with a office365 development tenant so I could give you the address and the credentials of a test user without any issues, so you can actually test our setup (our test server is publicly available) or also create you a test user in Gluu as it's all a testing environment separated from our production infrastructures and data. I would just rather send them via email and not post them here publicly. Either way I'm going to take the HAR files from Firefox and add them here.

By Vreixo Luis Gonzalez Caneda user 29 Apr 2021 at 2:19 p.m. CDT

Vreixo Luis Gonzalez Caneda gravatar
Here it's the HAR file from Firefox. If you want to actually test it you can go to https://login.microsoftonline.com and use this temporal test user without any license nor permissions associated and no permissions over Gluu either, other than access the profile: fromldapwindows@whispeak.fr 8fNAeNgPtE9w6s6H

By Aliaksandr Samuseu staff 29 Apr 2021 at 2:24 p.m. CDT

Aliaksandr Samuseu gravatar
Excellent, thanks! I'll give it a try.

By Vreixo Luis Gonzalez Caneda user 30 Apr 2021 at 3:13 a.m. CDT

Vreixo Luis Gonzalez Caneda gravatar
I'm attaching the HAR here with the calls https://www.dropbox.com/s/eyr4lxchqp5ti90/365-gluu.har?dl=0

By Vreixo Luis Gonzalez Caneda user 06 May 2021 at 9:31 a.m. CDT

Vreixo Luis Gonzalez Caneda gravatar
Hi, have you been able to reproduce our issues? If you need further details please don't hesitate as we would like to have the integration as soon as possible thanks in advance,

By Aliaksandr Samuseu staff 06 May 2021 at 3:07 p.m. CDT

Aliaksandr Samuseu gravatar
Hi. Sorry for the delayed answer. Yes, I was able to confirm that some inconsistencies on how to configure nameid for this integration exist in our docs. I'm currently trying to figure out the best way to achieve it in the recent Gluu Server package.