ADSF Claims questions
Brian Fox
dexwest at gmail.com
Mon Apr 30 22:58:16 BST 2012
I am running shibboleth 2.4.3. I am trying to run my shibboleth SP
against an ADFS idp, which is managed by someone else. When I give my
SP metadata to the person managing the ADFS they are saying that no
claims appear in ADFS under the Accepted claims tab.
I've tried to following the steps to make the standard shib SP work
with ADFS from
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPADFS.
Although most of these suggestions seemed to be based on < 2.4.
My attribute-map.xml looks like this:
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<!-- WS-Fed attributes -->
<Attribute nameFormat="http://schemas.xmlsoap.org/claims"
name="CommonName" id="cn">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute nameFormat="http://schemas.xmlsoap.org/claims"
name="EmailAddress" id="email">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="UPN"
id="userPrincipalName">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="GroupId"
id="sAMAccountName">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
</Attributes>
I see this in logs:
xxxx INFO Shibboleth.AttributeExtractor.XML : creating mapping for
Attribute CommonName, Format/Namespace:http://schemas.xmlsoap.org/claims
Can someone please help me figure out how to verify that my SP is
supplying any claims? Is it required for my SP to supply claims to the
IDP, or can I just let the IDP define the claims?
More information about the users
mailing list