Google Apps using Shibboleth

[Prasanna]

Chris,

Still the same...

*attribute filter*

<afp:AttributeFilterPolicy id="first"> 
         <afp:PolicyRequirementRule
xsi:type="basic:AttributeRequesterString" value="google.com/a/imperoidm.com"
/> 
         <afp:AttributeRule attributeID="principal"> 
             <afp:PermitValueRule xsi:type="basic:ANY" /> 
         </afp:AttributeRule> 
</afp:AttributeFilterPolicy> 

*attribute resolver *


<resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
	xmlns="urn:mace:shibboleth:2.0:resolver:ad">
	<resolver:AttributeEncoder xsi:type="SAML2StringNameID"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
		 nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
</resolver:AttributeDefinition>


*error*

19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:137]
- shibboleth.AttributeResolver resolved, for principal raj, the attributes:
[eduPersonAffiliation, eduPersonPrincipalName, principal, transientId,
eduPersonScopedAffiliation, eduPersonTargetedID.old, eduPersonTargetedID]
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:71]
- shibboleth.AttributeFilterEngine filtering 7 attributes for principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130]
- Evaluating if filter policy releaseToAnyone is active for principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:139]
- Filter policy releaseToAnyone is active for principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163]
- Processing permit value rule for attribute transientId for principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163]
- Processing permit value rule for attribute eduPersonScopedAffiliation for
principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163]
- Processing permit value rule for attribute eduPersonTargetedID.old for
principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163]
- Processing permit value rule for attribute eduPersonTargetedID for
principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130]
- Evaluating if filter policy first is active for principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:139]
- Filter policy first is active for principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163]
- Processing permit value rule for attribute principal for principal raj
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:106]
- Removing attribute from return set, no more values: eduPersonAffiliation
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:106]
- Removing attribute from return set, no more values: eduPersonPrincipalName
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:109]
- Attribute principal has 1 values after filtering
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:109]
- Attribute transientId has 1 values after filtering
19:51:44.659 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:109]
- Attribute eduPersonScopedAffiliation has 1 values after filtering
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:109]
- Attribute eduPersonTargetedID.old has 1 values after filtering
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:109]
- Attribute eduPersonTargetedID has 1 values after filtering
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:114]
- Filtered attributes for principal raj.  The following attributes remain:
[principal, transientId, eduPersonScopedAffiliation,
eduPersonTargetedID.old, eduPersonTargetedID]
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:501]
- Creating attribute statement in response to SAML request
'pgnmokilobnbkagmeeiikgmfegnpflhhedioidfm' from relying party
'google.com/a/imperoidm.com'
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:226]
- Attribute principal was not encoded because no SAML2AttributeEncoder was
attached to it.
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:226]
- Attribute transientId was not encoded because no SAML2AttributeEncoder was
attached to it.
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215]
- Encoded attribute eduPersonScopedAffiliation with encoder of type
edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2ScopedStringAttributeEncoder
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:226]
- Attribute eduPersonTargetedID.old was not encoded because no
SAML2AttributeEncoder was attached to it.
19:51:44.675 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215]
- Encoded attribute eduPersonTargetedID with encoder of type
edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2XMLObjectAttributeEncoder
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:509]
- Filtering out potential name identifier attributes which can not be
encoded by
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:523]
- Retaining attribute principal which may be encoded to via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:523]
- Retaining attribute transientId which may be encoded to via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528]
- Removing attribute eduPersonScopedAffiliation, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528]
- Removing attribute eduPersonTargetedID.old, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528]
- Removing attribute eduPersonTargetedID, it can not be encoded via
edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:548]
- Filtering out potential name identifier attributes which do not support
one of the following formats:
[urn:oasis:names:tc:SAML:1.1:nameidformat:unspecified]
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:573]
- Removing attribute principal, it can not be encoded in to a name
identifier of an acceptable format
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:573]
- Removing attribute transientId, it can not be encoded in to a name
identifier of an acceptable format
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:486]
- No attributes for principal 'raj' support encoding into a supported name
identifier format for relying party 'google.com/a/imperoidm.com'
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:568]
- Determining if SAML assertion to relying party
'google.com/a/imperoidm.com' should be signed
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:649]
- IdP relying party configuration 'google.com/a/imperoidm.com' indicates to
sign assertions: true
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:579]
- Determining signing credntial for assertion to relying party
'google.com/a/imperoidm.com'
19:51:44.690 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:595]
- Signing assertion to relying party google.com/a/imperoidm.com
19:51:44.909 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:778]
- Encoding response to SAML request pgnmokilobnbkagmeeiikgmfegnpflhhedioidfm
from relying party google.com/a/imperoidm.com
19:51:44.909 - WARN
[org.opensaml.saml2.binding.encoding.BaseSAML2MessageEncoder:134] - Relay
state exceeds 80 bytes, some application may not support this.
19:51:44.924 - INFO [Shibboleth-Audit:989] -
20121203T195144Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|pgnmokilobnbkagmeeiikgmfegnpflhhedioidfm|google.com/a/imperoidm.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://dc01.imperoidm.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_c287620455a148110dd8a71610b311eb|raj|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|principal,transientId,eduPersonScopedAffiliation,eduPersonTargetedID.old,eduPersonTargetedID,||_2acd48122db8f22eb4ec34decbaa4759,|


thanks
Prasanna



-----
Prasanna V B
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Google-Apps-using-Shibboleth-tp7583436p7583475.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.