Problems with eppn on the SP

[Wessel, Keith William]

Hi,

We're experiemting with using CA Siteminder's federation support as an IDP against the standard Shibboleth SP. We're getting some values through fine (transient ID, cn, etc.), but we're hitting some problems with eppn. My theory is that, from what we've seen so far, Siteminder doesn't support the concept of scoped attributes.

First question: I'm guessing that just sending through a basic string in the format of user at example.com<mailto:user at example.com> with format "unspecified" isn't good enough. By default, the SP is trying to decode a scoped attribute, and a string isn't the same as a scoped attribute. Is that correct?

Secondly, when we send through eppn, even after I change my attribute-map.xml on the sp to tell it to use a string attribute decoder instead of a scoped attribute decoder, the logs indicate that it continues to throw out the value we're sending.

>From shibd.log:
removed value at position (0) of attribute (eppn) from (https://entityID goes here)
no values left, removing attribute (eppn)...

Not that it'll work around the scoping issue, but can any suggest anything else we might look at to decode eppn and keep us from getting this value removal?

I'd send more info, but I'm not sure what else to send at this point.

Keith

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120621/4e0a652e/attachment.html