ADSF Claims questions

Brian Fox dexwest at gmail.com
Mon Apr 30 22:58:16 BST 2012


I am running shibboleth 2.4.3.  I am trying to run my shibboleth SP 
against an ADFS idp, which is managed by someone else.  When I give my 
SP metadata to the person managing the ADFS they are saying that no 
claims appear in ADFS under the Accepted claims tab.

I've tried to following  the steps to make the standard shib SP work 
with ADFS from 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPADFS.  
Although most of these suggestions seemed to be based on < 2.4.

My attribute-map.xml looks like this:
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<!-- WS-Fed attributes -->
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" 
name="CommonName" id="cn">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" 
name="EmailAddress" id="email">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="UPN" 
id="userPrincipalName">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="GroupId" 
id="sAMAccountName">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
</Attributes>

I see this in logs:
xxxx  INFO Shibboleth.AttributeExtractor.XML : creating mapping for 
Attribute CommonName, Format/Namespace:http://schemas.xmlsoap.org/claims

Can someone please help me figure out how to verify that my SP is 
supplying any claims?  Is it required for my SP to supply claims to the 
IDP, or can I just let the IDP define the claims?


More information about the users mailing list