carousel.md

Configure Shibolleth IdP for Carousel

(Unsolicited or IdP-Initiaited SSO)

1. Carousel provided this info:

        ACS Route: https://catholicuniversity.carouselsignage.net/carouselapi/v1/Saml2/Acs
        Entity ID: https://catholicuniversity.carouselsignage.net/carousel
        NameID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

2. Create an SP metadata XML file: metadata/carouselsignage.net.xml:

        <?xml version="1.0"?>
        <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2027-03-12T13:43:04Z" cacheDuration="PT604800S" entityID="https://catholicuniversity.carouselsignage.net/carousel">
            <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
                <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://catholicuniversity.carouselsignage.net/carouselapi/v1/Saml2/Acs" index="1" />
            </md:SPSSODescriptor>
        </md:EntityDescriptor>

3. Reference the metadata file in conf/metadata-providers.xml

        <MetadataProvider id="HTTPMetadataCarousel" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/carouselsignage.net.xml"/>

4. Release the email address attribute to this SP: conf/attribute-filter.xml :

        <AttributeFilterPolicy id="carousel">
            <PolicyRequirementRule xsi:type="Requester" value="https://catholicuniversity.carouselsignage.net/carousel" />
            <AttributeRule attributeID="email">
                <PermitValueRule xsi:type="ANY" />
            </AttributeRule>
        </AttributeFilterPolicy>

5. Carousel needs to be configured with this info:

Single Sign On URL: https://idp.cua.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fcatholicuniversity.carouselsignage.net%2Fcarousel

Identity Issuer ID: https://idp.cua.edu

X509 Certificate: 
<Paste your X509 signing certificate in PEM format>