Attributes being removed from SAML1 Service Provider because they cannot be encoded.

[Khanna, Sumit (khannast)]

We're having a problem with a SAML1 Service Provider
(https://soadev.nih.gov/FederationGateway). When we attempt to login, I can
see that our IDP is pulling and preparing to encode the attributes we allow
for InCommon. The attributes come up in the uApprove screen to, but when we
redirect back to the SP, the logs say that it can't encode our attributes
using the SAML1 encoder.  I've also included part of our attribute-resolve
below. Are our SAML1 AttributeEncoders correct or should those xsi:type
attributes be something else? 

 

 

10:31:39.376 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.Shi
bbolethAttributeFilteringEngine:113] - Filtered attributes for principal
<myusername>.  The following attributes remain: [eduPersonPrincipalName,
surname, eduPersonScopedAffiliation, givenName, eduPersonTargetedID, email,
displayName]

10:31:39.379 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml1.ShibbolethSSOEndpoint
Selector:79] - Selecting endpoint from metadata corresponding to provided
ACS URL: 'https://citdecadssolog.nih.gov/affwebservices/public/samlcc'

10:31:39.379 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml1.ShibbolethSSOEndpoint
Selector:83] - Relying party role contains '3' endpoints

10:31:39.382 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
509] - Filtering out potential name identifier attributes which can not be
encoded by
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.383 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
528] - Removing attribute eduPersonPrincipalName, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.383 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
528] - Removing attribute surname, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.384 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
528] - Removing attribute eduPersonScopedAffiliation, it can not be encoded
via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.384 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
528] - Removing attribute givenName, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.384 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
528] - Removing attribute eduPersonTargetedID, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.384 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
528] - Removing attribute email, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.385 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
528] - Removing attribute displayName, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdent
ifierEncoder

10:31:39.385 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
486] - No attributes for principal '<me again>' support encoding into a
supported name identifier format for relying party
'https://soadev.nih.gov/FederationGateway'

 

 

Attribute-resolver partial:

 

 

       <resolver:AttributeDefinition xsi:type="ad:Simple" id="commonName"
sourceAttributeID="cn">

        <resolver:Dependency ref="myLDAP" />

        <resolver:DisplayName xml:lang="en">Username</resolver:DisplayName>

        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:cn" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.3" friendlyName="cn" />

    </resolver:AttributeDefinition>

 

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="surname"
sourceAttributeID="sn">

        <resolver:Dependency ref="myLDAP" />

        <resolver:DisplayName xml:lang="en">Last Name</resolver:DisplayName>

        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:sn" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.4" friendlyName="sn" />

    </resolver:AttributeDefinition>

 

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="displayName"
sourceAttributeID="fullName">

        <resolver:Dependency ref="myLDAP" />

        <resolver:DisplayName xml:lang="en">Full Name</resolver:DisplayName>

        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:displayName" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.16.840.1.113730.3.1.241" />

    </resolver:AttributeDefinition>

 

.etc

 

Thanks

 

Sumit Khanna

Application Analyist 

EAI Team - University of Cincinnati 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20110802/4e4dd326/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5989 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20110802/4e4dd326/attachment-0001.bin