Getting attributes from an OpenAM 10 Idp

[Mike Flynn]

Well, since I have not aroused the ire of Scott or Tom in a while, here goes :)

I am running Shibboleth 2.x on IIS.

I am trying to get attributes to pass from an Idp based on the OpenAM 10 service.  We connect just fine.  Just trying to get the attributes to pass through...

They are passing a standard LDAP mail attribute.

From their assertion:

<saml:AttributeStatement>
<saml:Attribute Name="mail">
<saml:AttributeValue xmlns:xs="http://www.w3.org/ 2001/XMLSchema" xmlns:xsi="http://www.w3.org/ 2001/XMLSchema-instance" xsi:type="xs:string">auser@ someplace.com</saml: AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>

And their configuration defines mail as this:

<saml:Attribute Name="mail">
<saml:AttributeValue xmlns:xs="http://www.w3.org/ 2001/XMLSchema" xmlns:xsi="http://www.w3.org/ 2001/XMLSchema-instance" xsi:type="xs:string">cayetano@ adobe.com</saml: AttributeValue>
</saml:Attribute>

Now I have mail defined as this (default definition that came with Shib):

    <Attribute name="urn:mace:dir:attribute- def:mail" id="mail"/>

I am going to guess that the mace urn is not going to fly for them on this.  For another customer I defined an attribute for them like this:
     <Attribute name="qcmail" nameFormat="urn:oasis:names: tc:SAML:2.0:attrname-format: basic" id="qcmail"> 
<AttributeDecoder xsi:type=" StringAttributeDecoder" caseSensitive="false"/> 
</Attribute>

And that worked fine.  I am guessing that I will need to do a similar definition for mail (non MACE) for this to pass through.  My questions are:

Is the MACE name indeed what prevents the attribute from passing?  Since they would not match that name value on their side...

Next question (assuming that the MAC name is not going to fly...):

If I re-define, let's say, mail for example and I do it like this:

     <Attribute name="mail" nameFormat="urn:oasis:names: tc:SAML:2.0:attrname-format: basic" id="mail"> 
<AttributeDecoder xsi:type=" StringAttributeDecoder" caseSensitive="false"/> 
</Attribute>

Will the duplicate ID value of 'mail' conflict with the MACE version of the attribute?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120620/d8de98d7/attachment.html