employeeNumber from employeeID in active directory

[Chad La Joie]

No, what I said is you need to look at the logs to see what it says is
happening.  If your attribute definition is being invoked and produces
an attribute to be encoded it's going to tell you that.  A common
problem in this area is case-sensitivity, but if the single line of
log that you give is accurate then you have that right.

On Wed, Sep 7, 2011 at 10:55, Jean Robertson <jean.robertson at mcgill.ca> wrote:
> Hello,
>
> On September 7, 2011 09:38:37 am Chad La Joie wrote:
>> You'll have to check your logs on debug.
>
> I have set the Shibboleth-Process log to ALL to get all messages.
>
>> It will tell you which
>> attributes it gets back from LDAP,
>
> The idp-process.log says:
>
> LdapDataConnector:882] - Found the following attribute: employeeID=[150998702]
>
>> how many values it has,
>
> It only mentions the one value.
>
>> if those values are used by a given attribute definition,
>
> I specified that the value is used by the employeeNumber definition in the
> attibute-resolver.xml file. I am not sure I have to specify it elsewhere. I am
> not sure that I have properly specified it.
>
>> and if the created
>> attributes are released or not.
>
> It is not released.
> There is nothing in the log file that tells me where the value went or if it
> was used in any way.
>
> Jean
>
>
>
>
>> On Wed, Sep 7, 2011 at 09:13, Jean Robertson <jean.robertson at mcgill.ca>
> wrote:
>> > Hello,
>> >
>> > On September 6, 2011 05:26:18 pm Brent Putman wrote:
>> >> On 9/6/11 3:58 PM, Jean Robertson wrote:
>> >> > I have an attribute-resolver.xml snippet that looks like this:
>> >> >     <resolver:AttributeDefinition id="employeeNumber"
>> >> >
>> >> >         xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>> >> >         sourceAttributeID="employeeID">
>> >> >         <resolver:Dependency ref="myLDAP" />
>> >> >
>> >> >         <resolver:AttributeEncoder xsi:type="SAML1String"
>> >> >
>> >> >             xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>> >> >             name="urn:mace:dir:attribute-def:employeeNumber" />
>> >> >
>> >> >         <resolver:AttributeEncoder xsi:type="SAML2String"
>> >> >
>> >> >             xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>> >> >             name="urn:oid:2.16.840.1.113730.3.1.3"
>> >> >             friendlyName="employeeNumber" />
>> >> >
>> >> >     </resolver:AttributeDefinition>
>> >>
>> >> At first glance that looks ok.  Did you remember to also add or update a
>> >> rule to attribute-filter.xml to actually release the attribute to the
>> >> SP(s) you are using to test?
>> >
>> > Thanks for looking at this.
>> >
>> > Yes.
>> >
>> > Here is the rule:
>> >
>> >    <AttributeFilterPolicy id="releaseToShibSP">
>> >
>> > ..... lots cut out ....
>> >
>> >        <AttributeRule attributeID="employeeNumber">
>> >                <PermitValueRule xsi:type="basic:ANY" /> </AttributeRule>
>> >
>> >    </AttributeFilterPolicy>
>> >
>> >
>> > The weird thing is that the attribute employeeID (the source attribute)
>> > appears only once in the debug logs. Only to say that it was found.
>> >
>> > employeeNumber (what I am trying to pass to the test SP) does not appear
>> > anywhere.
>> >
>> > It does not appear later in the logs, with the other attributes when it
>> > comes time to resolve them
>> >
>> > For example of a successfully resolved attribute:
>> >
>> > Resolving attribute manager for principal jean.robertson at mcgill.ca
>> > Resolved attribute manager containing 1 values
>> >
>> > It does not appear either in the list of attributes sent to the test SP
>> >
>> > ShibbolethAttributeFilteringEngine:131] - Filter policy releaseToShibSP
>> > is active for principal jean.robertson
>> >
>> >
>> >
>> > Jean
>> >
>> > --
>> > Jean Robertson, McGill University (514) 398-8117
>> >
>> > --
>> > To unsubscribe from this list send an email to
>> > users-unsubscribe at shibboleth.net
>
> --
> Jean Robertson, McGill University (514) 398-8117
>
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered