Trouble with attributes from IBM

[Rob Whitener]

Hi All,

My team is setting up a Shibboleth2 SP and will be integrating with an IBM
Tivoli based IDP.  We have the connection in place as well as the
authentication flows.  What we are having trouble with now is decoding the
attributes coming back from the IDP.  Most of them have a name format URI
of urn:ibm:names:ITFIM:5.1:accessmanager, and we aren't sure if we have to
do anything extra to allow our SP to understand those formats.  We have the
attributes defined in attribute-map.xml like this:

    <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
name="altId">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>
    <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
name="zip">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>
    <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
name="dob">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>
    <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
name="email">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>
    <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
name="lastname">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>
    <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
name="firstname">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>
    <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
name="username">
        <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>

And we have our attribute-policy.xml looks like this (We think this should
just accept everything):
<afp:AttributeFilterPolicyGroup
    xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"
    xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
    xmlns:afp="urn:mace:shibboleth:2.0:afp"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<afp:AttributeFilterPolicy>
<!-- This policy is in effect in all cases. -->
<afp:PolicyRequirementRule xsi:type="ANY"/>
<afp:AttributeRule attributeID="*">
<afp:PermitValueRule xsi:type="ANY"/>
</afp:AttributeRule>
</afp:AttributeFilterPolicy>
</afp:AttributeFilterPolicyGroup>

And a snippet of the attributes that come from the IDP look like this:
<saml:AttributeStatement><saml:Attribute Name="id"
NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeV
alue
xsi:type="xs:string">525080438</saml:AttributeValue></saml:Attribute><saml:Attribute
Name="altId"
NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
xsi:ty
pe="xs:string">U00049591</saml:AttributeValue></saml:Attribute><saml:Attribute
Name="zip"
NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
xsi:type="xs:string
">02891</saml:AttributeValue></saml:Attribute><saml:Attribute Name="dob"
NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
xsi:type="xs:string">1951-01-01</sam
l:AttributeValue></saml:Attribute><saml:Attribute Name="email"
NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
xsi:type="xs:string">tri.chaugfdjjytrddhjjk at ci
gna.com</saml:AttributeValue>

Also, we are running Shibboleth 2.3 on Ubuntu 10.04 LTS.

Thank you,

Rob Whitener
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120702/cdff7dad/attachment.html