3.2.1: IdPPrincipalAttribute & attribute filtering policies

[Misagh Moayyed]

I am working on a prototype to learn how IdPPrincipalAttribute might work. I have set up external authn with an external servlet and in the final leg of authentication, I am passing a subject under SUBJECT_KEY back. Working off of a new in the archives, I let the final subject have 3 IdPPrincipalAttribute instances and a UsernamePrincipal. Each IdPPrincipalAttribute in the collection has an IdPAttribute wrapped inside it with a name and a String value. Attributes themselves don’t have display names, descriptions or encoders associated with them. Just an id and value(s). 

I can see ExternalAuthenticationImpl grabs the final subject fine. 

Then, I set up filtering policies for my SP, used “example1” for simplicity as the policy rule and indicated that all 3 of those attributes should be released regardless of value. None of those attributes are defined anywhere else in the IdP. They are just in the filtering policies. Then I see:

> Attribute Filter Policy 'example1'  Policy is active for this request
> Attribute Filter Policy 'example1'  Applying attribute filter policy to current set of attributes: [uid, eduPersonPrincipalName, eduPersonScopedAffiliation, mail]
> Attribute filtering engine '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_ce72f47d19f8ed927f12e9fea038874c'  Filtering values for attribute 'uid' which currently contains 1 values

What might I have to do to let the current set of attributes handle what is resolved outside the IdP from those principal attributes of the external context? 

-- 
Misagh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160825/b6a84ae3/attachment.html>