Attributes being removed from SAML1 Service Provider because they cannot be encoded.

[Khanna, Sumit (khannast)]

Thanks Tom!

So I tried your suggestion.  I created an attribute that looks like the
following:

    <resolver:AttributeDefinition id="eduPersonPrincipalName-Prescoped"
xsi:type="Prescoped"  xmlns="urn:mace:shibboleth:2.0:resolver:ad"
sourceAttributeID="uid">
     <resolver:Dependency ref="myLDAP" />
     <resolver:DisplayName xml:lang="en">Username</resolver:DisplayName>
     <resolver:AttributeEncoder xsi:type="SAML1ScopedString"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" scopeType="inline" />
     <resolver:AttributeEncoder xsi:type="SAML2ScopedString"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
        friendlyName="eduPersonPrincipalName" scopeType="inline" />
    </resolver:AttributeDefinition>

And the authentication works, but I get the following error immediately
afterwards in the idp-process.log:

12:55:09.123 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:176] -
Authentication succeeded for dn: cn=khannast,ou=People,o=uc
12:55:09.332 - ERROR
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attr
ibuteDefinition.PrescopedAttributeDefinition:71] - Input attribute value
khannast does not contain delimited @ and can not be split
12:55:09.339 - ERROR [ch.SWITCH.aai.uApprove.idpplugin.AttributeDumper:89] -
Unable to retrieve attributes Message
edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResol
utionException: Input attribute value can not be split.
        at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attri
buteDefinition.PrescopedAttributeDefinition.doResolve(PrescopedAttributeDefi
nition.java:73) ~[shibboleth-common-1.3.2.jar:na]
        at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attri
buteDefinition.BaseAttributeDefinition.resolve(BaseAttributeDefinition.java:
108) ~[shibboleth-common-1.3.2.jar:na]

....

12:55:09.340 - ERROR [ch.SWITCH.aai.uApprove.idpplugin.Plugin:124] -
uApprove error: Unable to retrieve attributes Message
13:02:37.079 - ERROR
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attr
ibuteDefinition.PrescopedAttributeDefinition:71] - Input attribute value
khannast does not contain delimited @ and can not be split
13:02:37.080 - ERROR [ch.SWITCH.aai.uApprove.idpplugin.AttributeDumper:89] -
Unable to retrieve attributes Message
edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResol
utionException: Input attribute value can not be split.
        at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attri
buteDefinition.PrescopedAttributeDefinition.doResolve(PrescopedAttributeDefi
nition.java:73) ~[shibboleth-common-1.3.2.jar:na]
        at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attri
buteDefinition.BaseAttributeDefinition.resolve(BaseAttributeDefinition.java:
108) ~[shibboleth-common-1.3.2.jar:na]
        at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attri
buteDefinition.BaseAttributeDefinition.resolve(BaseAttributeDefinition.java:
39) ~[shibboleth-common-1.3.2.jar:na]
        at
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attri
buteDefinition.ContextualAttributeDefinition.resolve(ContextualAttributeDefi
nition.java:93) ~[shibboleth-common-1.3.2.jar:na]

....

Sumit

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Tom Poage
Sent: Tuesday, August 02, 2011 1:49 PM
To: Shib Users
Subject: Re: Attributes being removed from SAML1 Service Provider because
they cannot be encoded.

NIH wants basically the same as NSF (research.gov) for SAML 1, in that they
want:

1. Attribute push. Probably easiest to create a <RelyingParty>, e.g.

> <RelyingParty id="their entityID" provider="your entityID"
defaultSigningCredentialRef="your credential ID">
>     <ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" 
> includeAttributeStatement="true"/>
> </RelyingParty>

2. ePPN labeled with its OID. Perhaps easiest to create a custom ePPN
definition for them.

> <resolver:AttributeDefinition id="eduPersonPrincipalName-NIH"
xsi:type="Prescoped" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
sourceAttributeID="your source attr">
>     <resolver:Dependency ref="your source identifier" />
>     <resolver:AttributeEncoder xsi:type="SAML1ScopedString"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" scopeType="inline" />
>     <resolver:AttributeEncoder xsi:type="SAML2ScopedString" 
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" 
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" 
> friendlyName="eduPersonPrincipalName" scopeType="inline" /> 
> </resolver:AttributeDefinition>

> <AttributeFilterPolicy id="NSF">
>     <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" 
> value="their entityID"/>
...
>     <AttributeRule attributeID="eduPersonPrincipalName-NIHNSF">
>         <PermitValueRule xsi:type="basic:ANY" />
>     </AttributeRule>
...

As far as I know, NIH doesn't support SAML 2 (yet).

Tom.

On 08/02/2011 10:16 AM, Khanna, Sumit (khannast) wrote:
> Sorry, I'm a little confused. So using SAML1, are SPs supposed to pull 
> attributes via the backchannel (is pushing not supported at all in 
> SAML1?) I contacted support for NIH (the SP) and was told "our 
> federation product is CA siteminder and this is not capable of pulling 
> SAML1 attributes through backchannel."
> 
> I was also a little confused because they required the following 
> attributes to be released:
> 
> urn:mace:dir:attribute-def:eduPersonPrincipalName,
> urn:mace:dir:attribute-def:mail, urn:mace:dir:attribute-def:sn, 
> urn:mace:dir:attribute-def:givenName, urn:oid:1.3.6.1.4.1.5923.1.1.1.6
> 
> In our attribute-resolver, we have all the urn:mace.. for the 
> SAML1String and SAML1XMLObject types and we use the OID for all the 
> SAML2 types. The OID
> 1.3.6.1.4.1.5923.1.1.6 already represents the eduPersonPrincipalName, 
> so I asked why it was included twice and was told:
> 
>>> Our product also cannot parse the attribute 
>>> urn:mace:dir:attribute-def:eduPersonPrincipalName as there is a 
>>> scope parameter attached to it so the new attribute
>>> urn:oid:1.3.6.1.4.1.5923.1.1.1.6 was designed by shibb developers 
>>> which
> has
>>> the value of scope as in-line. 
>>>
>>> The specific requirement for the shibb IPDs is to release the 
>>> attribute
>>> urn:oid:1.3.6.1.4.1.5923.1.1.1.6 to use our service provider.
> 
> I'm kinda lost here. Do I define a new parameter as a SAML1String 
> using the OID and how do I push those attributes via SAML1?
> 
> Sumit
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5989 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20110803/34955819/attachment.bin