eduPersonScopedAffiliation not mapping correctly

Scott Klawitter sklawitter at ebsco.com
Mon Dec 19 20:04:41 GMT 2011 

All,

I need help figuring out why an institution is not mapping the
eduPersonScopedAffiliation attribute correctly. I received help from
Scott previously and thought that I understood what change the IDP
needed to make.

I have spent time trying to understanding SAML (specifically SAML 2.0)
so that I can communicate with the users group better, and fix this
issue.

Here is the log information from shibd.log that I have. Any and all help
would be greatly appreciated.

---------------------------------------------------------

2011-12-19 11:05:02 DEBUG Shibboleth.Listener [11]: dispatching message
(default/SAML2/POST)
2011-12-19 11:05:02 DEBUG OpenSAML.MessageDecoder.SAML2POST [11]:
validating input
2011-12-19 11:05:02 DEBUG OpenSAML.MessageDecoder.SAML2POST [11]:
decoded SAML message:
<?xml version="1.0"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_34f65c876734bc86ca90182dbc8987dcbd219b803b"
InResponseTo="_c387527fc9a1f10ab783d94df6c61011" Version="2.0"
IssueInstant="2011-12-19T17:04:58Z"
Destination="https://shibboleth.metapress.com/Shibboleth.sso/SAML2/POST"
>
  <saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://www.rediris.e
s/sir/csicidp</saml:Issuer>
  <samlp:Status xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <samlp:StatusCode xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  </samlp:Status>
  <saml:Assertion Version="2.0"
ID="pfxe13110df-5ee3-8638-fce2-58be900bc934"
IssueInstant="2011-12-19T17:04:58Z">
    <saml:Issuer>https://www.rediris.es/sir/csicidp</saml:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
        <ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        <ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
        <ds:Reference URI="#pfxe13110df-5ee3-8638-fce2-58be900bc934">
          <ds:Transforms>
            <ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
            <ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          </ds:Transforms>
          <ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
          <ds:DigestValue>REMOVED=</ds:DigestValue>
        </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>==REMOVED==</ds:SignatureValue>
      <ds:KeyInfo>
        <ds:X509Data>
          <ds:X509Certificate>REMOVED</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </ds:Signature>
    <saml:Subject>
      <saml:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
SPNameQualifier="http://shibboleth.metapress.com/shibboleth-sp">_65aa969
97fc12f664dbbdfbba92a4b9b135adb17be</saml:NameID>
      <saml:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml:SubjectConfirmationData
NotOnOrAfter="2011-12-19T17:09:58Z"
InResponseTo="_c387527fc9a1f10ab783d94df6c61011"
Recipient="https://shibboleth.metapress.com/Shibboleth.sso/SAML2/POST"/>
      </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Conditions NotBefore="2011-12-19T17:04:28Z"
NotOnOrAfter="2011-12-19T17:09:58Z">
      <saml:AudienceRestriction>
 
<saml:Audience>http://shibboleth.metapress.com/shibboleth-sp</saml:Audie
nce>
      </saml:AudienceRestriction>
    </saml:Conditions>
    <saml:AuthnStatement AuthnInstant="2011-12-19T17:04:58Z"
SessionIndex="_9fad6c94d1fbcb33fcdf95822535656004dad6fb8e">
      <saml:AuthnContext>
 
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Passwo
rd</saml:AuthnContextClassRef>
      </saml:AuthnContext>
    </saml:AuthnStatement>
    <saml:AttributeStatement>
      <saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9">
        <saml:AttributeValue
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">member at cebas.csic.es<
/saml:AttributeValue>
      </saml:Attribute>
    </saml:AttributeStatement>
  </saml:Assertion>
</samlp:Response>

2011-12-19 11:05:02 DEBUG OpenSAML.MessageDecoder.SAML2 [11]: extracting
issuer from SAML 2.0 protocol message
2011-12-19 11:05:02 DEBUG OpenSAML.MessageDecoder.SAML2 [11]: message
from (https://www.rediris.es/sir/csicidp)
2011-12-19 11:05:02 DEBUG OpenSAML.MessageDecoder.SAML2 [11]: searching
metadata for message issuer...
2011-12-19 11:05:02 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [11]:
evaluating message flow policy (replay checking on, expiration 60)
2011-12-19 11:05:02 DEBUG XMLTooling.StorageService [11]: inserted
record (_34f65c876734bc86ca90182dbc8987dcbd219b803b) in context
(MessageFlow)
2011-12-19 11:05:02 DEBUG Shibboleth.SSO.SAML2 [11]: processing message
against SAML 2.0 SSO profile
2011-12-19 11:05:02 DEBUG Shibboleth.SSO.SAML2 [11]: extracting issuer
from SAML 2.0 assertion
2011-12-19 11:05:02 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [11]:
evaluating message flow policy (replay checking on, expiration 60)
2011-12-19 11:05:02 DEBUG XMLTooling.StorageService [11]: inserted
record (pfxe13110df-5ee3-8638-fce2-58be900bc934) in context
(MessageFlow)
2011-12-19 11:05:02 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [11]:
validating signature profile
2011-12-19 11:05:02 DEBUG XMLTooling.TrustEngine.ExplicitKey [11]:
attempting to validate signature with the peer's credentials
2011-12-19 11:05:02 DEBUG XMLTooling.TrustEngine.ExplicitKey [11]:
signature validated with credential
2011-12-19 11:05:02 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [11]:
signature verified against message issuer
2011-12-19 11:05:02 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation
[11]: assertion satisfied bearer confirmation requirements
2011-12-19 11:05:02 DEBUG Shibboleth.SSO.SAML2 [11]: SSO profile
processing completed successfully
2011-12-19 11:05:02 DEBUG Shibboleth.SSO.SAML2 [11]: extracting pushed
attributes...
2011-12-19 11:05:02 DEBUG Shibboleth.AttributeExtractor.XML [11]:
skipping unmapped NameID with format
(urn:oasis:names:tc:SAML:2.0:nameid-format:transient)
2011-12-19 11:05:02 INFO Shibboleth.AttributeExtractor.XML [11]:
skipping unmapped SAML 2.0 Attribute with Name:
urn:oid:1.3.6.1.4.1.5923.1.1.1.9,
Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
2011-12-19 11:05:02 DEBUG Shibboleth.SSO.SAML2 [11]: resolving
attributes...
2011-12-19 11:05:02 DEBUG Shibboleth.AttributeResolver.Query [11]: found
AttributeStatement in input to new session, skipping query
2011-12-19 11:05:02 DEBUG Shibboleth.SessionCache [11]: creating new
session
2011-12-19 11:05:02 DEBUG Shibboleth.SessionCache [11]: storing new
session...
2011-12-19 11:05:02 DEBUG XMLTooling.StorageService [11]: inserted
record (session) in context (_c6339bcc9ad955b362ba51637f5b4f71)
2011-12-19 11:05:02 DEBUG XMLTooling.StorageService [11]: inserted
record (_65aa96997fc12f664dbbdfbba92a4b9b135adb17be) in context (NameID)
2011-12-19 11:05:02 DEBUG XMLTooling.StorageService [11]: inserted
record (pfxe13110df-5ee3-8638-fce2-58be900bc934) in context
(_c6339bcc9ad955b362ba51637f5b4f71)
2011-12-19 11:05:02 INFO Shibboleth.SessionCache [11]: new session
created: ID (_c6339bcc9ad955b362ba51637f5b4f71) IdP
(https://www.rediris.es/sir/csicidp)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (130.206.XXX.XXX)
2011-12-19 11:05:02 DEBUG Shibboleth.SSO.SAML2 [11]: ACS returning via
redirect to:
https://shibboleth.metapress.com/secure/session-collector.axd?returnUrl=
http%3a%2f%2fwww.metapress.com%3a80%2fhome%2fmain.mpx%3ftoken%3d%7b0%7d
2011-12-19 11:05:02 DEBUG Shibboleth.Listener [11]: dispatching message
(find::StorageService::SessionCache)
2011-12-19 11:05:02 DEBUG XMLTooling.StorageService [11]: updated
expiration of valid records in context
(_c6339bcc9ad955b362ba51637f5b4f71)

---------------------------------------------------------

NOTE: I HAVE ATTEMPTED TO REMOVE ANY AND ALL SENSITIVE INFORMATION!!!


Thank you,

Scott Klawitter

More information about the users mailing list