Problems with eppn on the SP

[Cantor, Scott]

On 6/21/12 12:09 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:

>We¹re experiemting with using CA Siteminder¹s federation support as an
>IDP against the standard Shibboleth SP. We¹re getting some values through
>fine (transient ID, cn, etc.), but we¹re hitting some problems with eppn.
>My theory is that, from what we¹ve seen so far, Siteminder doesn¹t
>support the concept of scoped attributes.

It doesn't, but that only depends on the SP.

> 
>First question: I¹m guessing that just sending through a basic string in
>the format of
>user at example.com with format ³unspecified² isn¹t good enough. By default,
>the SP is trying to decode a scoped attribute, and a string isn¹t the
>same as a scoped attribute. Is that correct?

No. Inline scoping is fully supported, and unspecified formats are now
ignored as wildcards, which is why your extraction is working. If it
wasn't, it couldn't be filtering anything.

> 
>Secondly, when we send through eppn, even after I change my
>attribute-map.xml on the sp to tell it to use a string attribute decoder
>instead of a scoped attribute decoder, the logs indicate that it
>continues to throw out the value we¹re
> sending.

You actually broke it. You changed the decode to "String", but the filter
policy requires that it be scoped, and thus any unscoped values are
removed. Change it back and it will work. If your metadata is correct,
anyway.

-- Scott