Programmatic Access to SP Attributes

Tue Jul 31 11:53:01 EDT 2012

So I have a WebLogic 12c IdP "working" with a Shibboleth SP for version
2.4.3 running on IIS 7.5.  The IdP and SP are both running on my local
machine, while I figure out how to do all this.  There are some page
protection issues, but I worked around them by hitting the /Login with a
target parameter set to the site I need to have SSO access to (I'm more
worried about the communications between IdP and SP than site protection at
the moment).  I can see the assertions are being received by the SP because
I have checked the logs and I am able to see not only the assertion XML in
the log, but the SP is parsing it out and attempting to retrieve attributes
from it.

Now comes in the part I'm stuck on.  The WebLogic IdP won't send a whole lot
of info in the assertion, but among the pieces being sent that I find useful
is the subject NameID node, because that contains the name of the user who's
involved in the SSO session.  The XML node is in this format:

<saml:Subject>

<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
NameQualifier="www.mysite.com">ssouser</saml:NameID>

. more XML .

</saml:Subject>

The SP does actually parse this after I added this entry into the
attribute-map.xml file:

<Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
id="NameID">

                <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$Name" defaultQualifiers="true"/>

</Attribute>

I can see in the shibd.log that it generates the session, and when I check
the transaction.log, I see this:

2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]: New session (ID:
_ef838acca244cf6f8b7c9b2be9bc58f9) with (applicationId: default) for
principal from (IdP: saml2CMP) at (ClientAddress: 127.0.0.1) with
(NameIdentifier: ssouser) using (Protocol:
urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID:
_0xdf9ec404c90318c0d9f4b9afe21b1067)

2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]: Cached the following
attributes with session (ID: _ef838acca244cf6f8b7c9b2be9bc58f9) for
(applicationId: default) {

2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]:               NameID (1
values)

2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]: }

Now comes my problem.  I can't figure out how to retrieve that value, which
would be used to display the active user.  When I set tracing on for the ASP
.NET page, I can see that a _shibsession object is added to the ALL_HTTP
elements only after the SSO actions have been completed.
Request.Headers("NameID") doesn't work (always returns a null value).  I'm
not even sure if I'm using attributes appropriately, because none of the
other shibboleth session values are generated (they all seem to be coming
back null when I try Request.Headers("Shib-property")).  This may be because
the IdP is not sending a lot of info, or it could just be the fact that I'm
new to all this.  I'm using VB on .NET version 3.5.

Here's the log snippet from shibd.log that shows the attributes being
extracted and the session constructed.  The "group" attribute is ignored on
purpose because it is not by the application the SP is designed to protect.

2012-07-31 10:01:20 DEBUG Shibboleth.SSO.SAML2 [1]: extracting pushed
attributes...

2012-07-31 10:01:20 DEBUG Shibboleth.AttributeDecoder.NameID [1]: decoding
NameIDAttribute (NameID) from SAML 2 NameID with Format
(urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified)

2012-07-31 10:01:20 INFO Shibboleth.AttributeExtractor.XML [1]: skipping
unmapped SAML 2.0 Attribute with Name: Groups,
Format:urn:oasis:names:tc:SAML:2.0:attrname-format:basic

2012-07-31 10:01:20 DEBUG Shibboleth.AttributeFilter [1]: filtering 1
attribute(s) from (saml2CMP)

2012-07-31 10:01:20 DEBUG Shibboleth.AttributeFilter [1]: applying filtering
rule(s) for attribute (NameID) from (saml2CMP)

2012-07-31 10:01:20 DEBUG Shibboleth.SSO.SAML2 [1]: resolving attributes...

2012-07-31 10:01:20 DEBUG Shibboleth.AttributeResolver.Query [1]: found
AttributeStatement in input to new session, skipping query

2012-07-31 10:01:20 DEBUG Shibboleth.SessionCache [1]: creating new session

2012-07-31 10:01:20 DEBUG Shibboleth.SessionCache [1]: storing new
session...

2012-07-31 10:01:20 DEBUG XMLTooling.StorageService [1]: inserted record
(session) in context (_ef838acca244cf6f8b7c9b2be9bc58f9) with expiration
(1343746880)

2012-07-31 10:01:20 DEBUG XMLTooling.StorageService [1]: inserted record
(ssouser) in context (NameID) with expiration (1343772080)

2012-07-31 10:01:20 DEBUG XMLTooling.StorageService [1]: inserted record
(_0xdf9ec404c90318c0d9f4b9afe21b1067) in context
(_ef838acca244cf6f8b7c9b2be9bc58f9) with expiration (1343746880)

2012-07-31 10:01:20 INFO Shibboleth.SessionCache [1]: new session created:
ID (_ef838acca244cf6f8b7c9b2be9bc58f9) IdP (saml2CMP)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (127.0.0.1)

Jeff

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120731/614f4cfc/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 10760 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120731/614f4cfc/attachment-0001.bin 