Trouble with attributes from IBM

[Pete Newing]

Hi Rob,
I recently had to do the same thing but ended up with something much
simpler than you describe.

In 'shibboleth2.xml' I have:
<SSO entityID="https://some.url.for.your.Idp"
NameIDFormat="nameIDformat.that.you.want.to.use">
                SAML2 SAML1
            </SSO>

... and then in 'attribute-map.xml'... (for example)
<Attribute name="nameIDformat.that.you.want.to.use" id="varname"/>

...  and finally back in 'shibboleth2.xml'...
REMOTE_USER="varname"

That's all I needed. Hopefully this will help...
Regards, Pete

On 2 July 2012 22:28, Rob Whitener <rob.whitener at audaxhealth.com> wrote:

> Hi All,
>
> My team is setting up a Shibboleth2 SP and will be integrating with an IBM
> Tivoli based IDP.  We have the connection in place as well as the
> authentication flows.  What we are having trouble with now is decoding the
> attributes coming back from the IDP.  Most of them have a name format URI
> of urn:ibm:names:ITFIM:5.1:accessmanager, and we aren't sure if we have
> to do anything extra to allow our SP to understand those formats.  We have
> the attributes defined in attribute-map.xml like this:
>
>     <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
> name="altId">
>         <AttributeDecoder xsi:type="StringAttributeDecoder"
> caseSensitive="false"/>
>     </Attribute>
>     <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
> name="zip">
>         <AttributeDecoder xsi:type="StringAttributeDecoder"
> caseSensitive="false"/>
>     </Attribute>
>     <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
> name="dob">
>         <AttributeDecoder xsi:type="StringAttributeDecoder"
> caseSensitive="false"/>
>     </Attribute>
>     <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
> name="email">
>         <AttributeDecoder xsi:type="StringAttributeDecoder"
> caseSensitive="false"/>
>     </Attribute>
>     <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
> name="lastname">
>         <AttributeDecoder xsi:type="StringAttributeDecoder"
> caseSensitive="false"/>
>     </Attribute>
>     <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
> name="firstname">
>         <AttributeDecoder xsi:type="StringAttributeDecoder"
> caseSensitive="false"/>
>     </Attribute>
>     <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager"
> name="username">
>         <AttributeDecoder xsi:type="StringAttributeDecoder"
> caseSensitive="false"/>
>     </Attribute>
>
> And we have our attribute-policy.xml looks like this (We think this should
> just accept everything):
> <afp:AttributeFilterPolicyGroup
>     xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"
>     xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
>     xmlns:afp="urn:mace:shibboleth:2.0:afp"
>     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
>
> <afp:AttributeFilterPolicy>
> <!-- This policy is in effect in all cases. -->
> <afp:PolicyRequirementRule xsi:type="ANY"/>
> <afp:AttributeRule attributeID="*">
> <afp:PermitValueRule xsi:type="ANY"/>
> </afp:AttributeRule>
> </afp:AttributeFilterPolicy>
> </afp:AttributeFilterPolicyGroup>
>
> And a snippet of the attributes that come from the IDP look like this:
> <saml:AttributeStatement><saml:Attribute Name="id"
> NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeV
> alue
> xsi:type="xs:string">525080438</saml:AttributeValue></saml:Attribute><saml:Attribute
> Name="altId"
> NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
> xsi:ty
> pe="xs:string">U00049591</saml:AttributeValue></saml:Attribute><saml:Attribute
> Name="zip"
> NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
> xsi:type="xs:string
> ">02891</saml:AttributeValue></saml:Attribute><saml:Attribute Name="dob"
> NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
> xsi:type="xs:string">1951-01-01</sam
> l:AttributeValue></saml:Attribute><saml:Attribute Name="email"
> NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue
> xsi:type="xs:string">tri.chaugfdjjytrddhjjk at ci
> gna.com</saml:AttributeValue>
>
> Also, we are running Shibboleth 2.3 on Ubuntu 10.04 LTS.
>
> Thank you,
>
> Rob Whitener
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 

*Peter L.K. Newing, CISSP, CISA, ITIL V3 Foundation, ISO 27001 Lead Auditor*

*Director of **Product Management*

* *
UK Mobile: +44 7545 073 406
US Mobile: +1 424 789 0265



Flexeye Technology Ltd



This email and any attachments are confidential and may be privileged.  If
you have received it in error, do not read it, copy it, forward it,
disclose its contents or use it for any purpose.  Please notify us
immediately and then delete it.  Any views or opinions expressed are solely
those of the author and not necessarily those of Flexeye Technology Ltd.
This email was sent from Flexeye Technology Limited, Hays House, Millmead,
Guildford GU2 4HJ. Registered Office: Wey Court West, Union Road, Farnham,
Surrey GU9 7PT United Kingdom.  Registered in England No 4852559. VAT no GB
821 3432 66A
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120703/7d3862ef/attachment.html