Adding a New Relying Party to Shibboleth Identity Provider

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
  1. Define relying party in the <install_folder>/conf/relaying-party.xml file. c:relyingPartyIds must include your Entity ID from Jamf Pro.
    Example:
    <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'JamfPro','JamfPro2'}}">
        <property name="profileConfigurations">
            <list>
                <bean parent="SAML2.SSO" p:encryptAssertions="never" p:signAssertions="never" p:encryptNameIDs="never" p:signResponses="never" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
        <ref bean="SAML2.Logout" />
            </list>
        </property>
    </bean>
  2. In Jamf Pro, navigate to Settings > System > Single Sign-On and click Download Jamf Pro Metadata.

    You may also download the metadata from the Jamf Pro URL.

    Example:

    https://instancename.jamfcloud.com/saml/SSO

  3. Create a new metadata provider in the <install_folder>/conf/metadata-providers.xml file.
    1. Specify your application ID.
      Example:

      Jamf Pro

    2. The metadataFile attribute must point to a local copy of your Jamf Pro metadata.
      Example:
      <MetadataProvider id="JamfPro"  xsi:type="FilesystemMetadataProvider" metadataFile="/home/user/jss-metdata.xml"/>
    3. MetadataProvider can read metadata from the Jamf Pro URL.

      For more information see the Shibboleth Service Provider documentation.

  4. Add a new attribute rule for your application in the <install_folder>/conf/attribute-filter.xml file.
    Example:
    <AttributeFilterPolicy id="Jamf Pro">
        <PolicyRequirementRule xsi:type="Requester" value="JamfPro"/>
        <AttributeRule attributeID="eduPersonPrincipalName">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
        <AttributeRule attributeID="uid">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
        <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
<AttributeRule attributeID="group">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
    </AttributeFilterPolicy