employeeNumber from employeeID in active directory

[Chad La Joie]

Well, if there is truly nothing in the logs then the IdP isn't using
the config you think it's using.  Even if there were no value for the
source attribute you'd see a line saying it was executing the
attribute definition.

On Wed, Sep 7, 2011 at 11:58, Jean Robertson <jean.robertson at mcgill.ca> wrote:
> On September 7, 2011 11:19:10 am Chad La Joie wrote:
>> No, what I said is you need to look at the logs to see what it says is
>> happening.  If your attribute definition is being invoked and produces
>> an attribute to be encoded it's going to tell you that.
>
> It does not tell me that. It does not tell me anything.
>
> The only thing it says is that the AD LDAP server provided the IdP with the
> data.
>
> After that, nothing.
>
>> A common
>> problem in this area is case-sensitivity, but if the single line of
>> log that you give is accurate then you have that right.
>
> I have checked case sensitivity of the incoming attribute (employeeID) and my
> attempt at an outgoing attribute (employeeNumber).
>
> It all seems fine to me: I see exactly the same name in the attribute-
> filter.xml file.
>
> This is shib IdP version 2.1.5, if that makes a difference.
>
> Jean
>
>
>
>
>
>> On Wed, Sep 7, 2011 at 10:55, Jean Robertson <jean.robertson at mcgill.ca>
> wrote:
>> > Hello,
>> >
>> > On September 7, 2011 09:38:37 am Chad La Joie wrote:
>> >> You'll have to check your logs on debug.
>> >
>> > I have set the Shibboleth-Process log to ALL to get all messages.
>> >
>> >> It will tell you which
>> >> attributes it gets back from LDAP,
>> >
>> > The idp-process.log says:
>> >
>> > LdapDataConnector:882] - Found the following attribute:
>> > employeeID=[150998702]
>> >
>> >> how many values it has,
>> >
>> > It only mentions the one value.
>> >
>> >> if those values are used by a given attribute definition,
>> >
>> > I specified that the value is used by the employeeNumber definition in
>> > the attibute-resolver.xml file. I am not sure I have to specify it
>> > elsewhere. I am not sure that I have properly specified it.
>> >
>> >> and if the created
>> >> attributes are released or not.
>> >
>> > It is not released.
>> > There is nothing in the log file that tells me where the value went or if
>> > it was used in any way.
>> >
>> > Jean
>> >
>> >> On Wed, Sep 7, 2011 at 09:13, Jean Robertson <jean.robertson at mcgill.ca>
>> >
>> > wrote:
>> >> > Hello,
>> >> >
>> >> > On September 6, 2011 05:26:18 pm Brent Putman wrote:
>> >> >> On 9/6/11 3:58 PM, Jean Robertson wrote:
>> >> >> > I have an attribute-resolver.xml snippet that looks like this:
>> >> >> >     <resolver:AttributeDefinition id="employeeNumber"
>> >> >> >
>> >> >> >         xsi:type="Simple"
>> >> >> > xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>> >> >> > sourceAttributeID="employeeID">
>> >> >> >         <resolver:Dependency ref="myLDAP" />
>> >> >> >
>> >> >> >         <resolver:AttributeEncoder xsi:type="SAML1String"
>> >> >> >
>> >> >> >             xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>> >> >> >             name="urn:mace:dir:attribute-def:employeeNumber" />
>> >> >> >
>> >> >> >         <resolver:AttributeEncoder xsi:type="SAML2String"
>> >> >> >
>> >> >> >             xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>> >> >> >             name="urn:oid:2.16.840.1.113730.3.1.3"
>> >> >> >             friendlyName="employeeNumber" />
>> >> >> >
>> >> >> >     </resolver:AttributeDefinition>
>> >> >>
>> >> >> At first glance that looks ok.  Did you remember to also add or
>> >> >> update a rule to attribute-filter.xml to actually release the
>> >> >> attribute to the SP(s) you are using to test?
>> >> >
>> >> > Thanks for looking at this.
>> >> >
>> >> > Yes.
>> >> >
>> >> > Here is the rule:
>> >> >
>> >> >    <AttributeFilterPolicy id="releaseToShibSP">
>> >> >
>> >> > ..... lots cut out ....
>> >> >
>> >> >        <AttributeRule attributeID="employeeNumber">
>> >> >                <PermitValueRule xsi:type="basic:ANY" />
>> >> > </AttributeRule>
>> >> >
>> >> >    </AttributeFilterPolicy>
>> >> >
>> >> >
>> >> > The weird thing is that the attribute employeeID (the source
>> >> > attribute) appears only once in the debug logs. Only to say that it
>> >> > was found.
>> >> >
>> >> > employeeNumber (what I am trying to pass to the test SP) does not
>> >> > appear anywhere.
>> >> >
>> >> > It does not appear later in the logs, with the other attributes when
>> >> > it comes time to resolve them
>> >> >
>> >> > For example of a successfully resolved attribute:
>> >> >
>> >> > Resolving attribute manager for principal jean.robertson at mcgill.ca
>> >> > Resolved attribute manager containing 1 values
>> >> >
>> >> > It does not appear either in the list of attributes sent to the test
>> >> > SP
>> >> >
>> >> > ShibbolethAttributeFilteringEngine:131] - Filter policy
>> >> > releaseToShibSP is active for principal jean.robertson
>> >> >
>> >> >
>> >> >
>> >> > Jean
>> >> >
>> >> > --
>> >> > Jean Robertson, McGill University (514) 398-8117
>> >> >
>> >> > --
>> >> > To unsubscribe from this list send an email to
>> >> > users-unsubscribe at shibboleth.net
>> >
>> > --
>> > Jean Robertson, McGill University (514) 398-8117
>
> --
> Jean Robertson, McGill University (514) 398-8117
>
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered