fixed -- Re: employeeNumber from employeeID in active directory

[Jean Robertson]

On September 7, 2011 12:11:16 pm Ashok Kumar wrote:
> You may check the value of employeeID is coming correctly from AD with
> ldapsearch. Also you can check the the attribute values with aacli command
> from IdP and see the corresponding debug level idp process logs.
> 
> Process logs can tell you what's happening when you are running aacli
> command.
> 
> Here is the info about aacli.
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/AACLI

The aacli command helped me discover the problem.

aacli does not use the running tomcat service.

Rather it checks one's config files.

This permitted me to see that the attribute was being resolved correctly.

I then concluded that the tomcat service had to be restarted.

That fixed the problem.

As well, Chad's comment 
"Well, if there is truly nothing in the logs then the IdP isn't using
the config you think it's using."

Pointed me to a service restart.

Thanks for all your help.

Jean






> On Wed, Sep 7, 2011 at 8:58 AM, Jean Robertson 
<jean.robertson at mcgill.ca>wrote:
> > On September 7, 2011 11:19:10 am Chad La Joie wrote:
> > > No, what I said is you need to look at the logs to see what it says is
> > > happening.  If your attribute definition is being invoked and produces
> > > an attribute to be encoded it's going to tell you that.
> > 
> > It does not tell me that. It does not tell me anything.
> > 
> > The only thing it says is that the AD LDAP server provided the IdP with
> > the data.
> > 
> > After that, nothing.
> > 
> > > A common
> > > problem in this area is case-sensitivity, but if the single line of
> > > log that you give is accurate then you have that right.
> > 
> > I have checked case sensitivity of the incoming attribute (employeeID)
> > and my
> > attempt at an outgoing attribute (employeeNumber).
> > 
> > It all seems fine to me: I see exactly the same name in the attribute-
> > filter.xml file.
> > 
> > This is shib IdP version 2.1.5, if that makes a difference.
> > 
> > Jean
> > 
> > > On Wed, Sep 7, 2011 at 10:55, Jean Robertson <jean.robertson at mcgill.ca>
> > 
> > wrote:
> > > > Hello,
> > > > 
> > > > On September 7, 2011 09:38:37 am Chad La Joie wrote:
> > > >> You'll have to check your logs on debug.
> > > > 
> > > > I have set the Shibboleth-Process log to ALL to get all messages.
> > > > 
> > > >> It will tell you which
> > > >> attributes it gets back from LDAP,
> > > > 
> > > > The idp-process.log says:
> > > > 
> > > > LdapDataConnector:882] - Found the following attribute:
> > > > employeeID=[150998702]
> > > > 
> > > >> how many values it has,
> > > > 
> > > > It only mentions the one value.
> > > > 
> > > >> if those values are used by a given attribute definition,
> > > > 
> > > > I specified that the value is used by the employeeNumber definition
> > > > in the attibute-resolver.xml file. I am not sure I have to specify
> > > > it elsewhere. I am not sure that I have properly specified it.
> > > > 
> > > >> and if the created
> > > >> attributes are released or not.
> > > > 
> > > > It is not released.
> > > > There is nothing in the log file that tells me where the value went
> > > > or
> > 
> > if
> > 
> > > > it was used in any way.
> > > > 
> > > > Jean
> > > > 
> > > >> On Wed, Sep 7, 2011 at 09:13, Jean Robertson <
> > 
> > jean.robertson at mcgill.ca>
> > 
> > > > wrote:
> > > >> > Hello,
> > > >> > 
> > > >> > On September 6, 2011 05:26:18 pm Brent Putman wrote:
> > > >> >> On 9/6/11 3:58 PM, Jean Robertson wrote:
> > > >> >> > I have an attribute-resolver.xml snippet that looks like this:
> > > >> >> >     <resolver:AttributeDefinition id="employeeNumber"
> > > >> >> >     
> > > >> >> >         xsi:type="Simple"
> > > >> >> > 
> > > >> >> > xmlns="urn:mace:shibboleth:2.0:resolver:ad"
> > > >> >> > sourceAttributeID="employeeID">
> > > >> >> > 
> > > >> >> >         <resolver:Dependency ref="myLDAP" />
> > > >> >> >         
> > > >> >> >         <resolver:AttributeEncoder xsi:type="SAML1String"
> > > >> >> >         
> > > >> >> >             xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> > > >> >> >             name="urn:mace:dir:attribute-def:employeeNumber" />
> > > >> >> >         
> > > >> >> >         <resolver:AttributeEncoder xsi:type="SAML2String"
> > > >> >> >         
> > > >> >> >             xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> > > >> >> >             name="urn:oid:2.16.840.1.113730.3.1.3"
> > > >> >> >             friendlyName="employeeNumber" />
> > > >> >> >     
> > > >> >> >     </resolver:AttributeDefinition>
> > > >> >> 
> > > >> >> At first glance that looks ok.  Did you remember to also add or
> > > >> >> update a rule to attribute-filter.xml to actually release the
> > > >> >> attribute to the SP(s) you are using to test?
> > > >> > 
> > > >> > Thanks for looking at this.
> > > >> > 
> > > >> > Yes.
> > > >> > 
> > > >> > Here is the rule:
> > > >> >    <AttributeFilterPolicy id="releaseToShibSP">
> > > >> > 
> > > >> > ..... lots cut out ....
> > > >> > 
> > > >> >        <AttributeRule attributeID="employeeNumber">
> > > >> >        
> > > >> >                <PermitValueRule xsi:type="basic:ANY" />
> > > >> > 
> > > >> > </AttributeRule>
> > > >> > 
> > > >> >    </AttributeFilterPolicy>
> > > >> > 
> > > >> > The weird thing is that the attribute employeeID (the source
> > > >> > attribute) appears only once in the debug logs. Only to say that
> > > >> > it was found.
> > > >> > 
> > > >> > employeeNumber (what I am trying to pass to the test SP) does not
> > > >> > appear anywhere.
> > > >> > 
> > > >> > It does not appear later in the logs, with the other attributes
> > > >> > when it comes time to resolve them
> > > >> > 
> > > >> > For example of a successfully resolved attribute:
> > > >> > 
> > > >> > Resolving attribute manager for principal jean.robertson at mcgill.ca
> > > >> > Resolved attribute manager containing 1 values
> > > >> > 
> > > >> > It does not appear either in the list of attributes sent to the
> > > >> > test SP
> > > >> > 
> > > >> > ShibbolethAttributeFilteringEngine:131] - Filter policy
> > > >> > releaseToShibSP is active for principal jean.robertson
> > > >> > 
> > > >> > 
> > > >> > 
> > > >> > Jean
> > > >> > 
> > > >> > --
> > > >> > Jean Robertson, McGill University (514) 398-8117
> > > >> > 
> > > >> > --
> > > >> > To unsubscribe from this list send an email to
> > > >> > users-unsubscribe at shibboleth.net
> > > > 
> > > > --
> > > > Jean Robertson, McGill University (514) 398-8117
> > 
> > --
> > Jean Robertson, McGill University (514) 398-8117
> > 
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> 
> --

-- 
Jean Robertson, McGill University (514) 398-8117