Problems with eppn on the SP

[Wessel, Keith William]

We actually started, Scott, with the scoped decoder and got this error. That's why I tried changing it to a string decoder instead.

If our metadata's correct is the key, I believe. We need to have the proper extension in the metadata for the IDP to tell the SP that example.com is a valid scope for this IDP to assert. Is that correct? If so, trivial fix; we'll just add that extension in, and we'll be golden. Sadly, the metadata generated by Siteminder's IDP is sparse to say the least.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, June 21, 2012 11:16 AM
To: Shib Users
Subject: Re: Problems with eppn on the SP

On 6/21/12 12:09 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:

>We¹re experiemting with using CA Siteminder¹s federation support as an 
>IDP against the standard Shibboleth SP. We¹re getting some values 
>through fine (transient ID, cn, etc.), but we¹re hitting some problems with eppn.
>My theory is that, from what we¹ve seen so far, Siteminder doesn¹t 
>support the concept of scoped attributes.

It doesn't, but that only depends on the SP.

> 
>First question: I¹m guessing that just sending through a basic string 
>in the format of user at example.com with format ³unspecified² isn¹t good 
>enough. By default, the SP is trying to decode a scoped attribute, and 
>a string isn¹t the same as a scoped attribute. Is that correct?

No. Inline scoping is fully supported, and unspecified formats are now ignored as wildcards, which is why your extraction is working. If it wasn't, it couldn't be filtering anything.

> 
>Secondly, when we send through eppn, even after I change my 
>attribute-map.xml on the sp to tell it to use a string attribute 
>decoder instead of a scoped attribute decoder, the logs indicate that 
>it continues to throw out the value we¹re  sending.

You actually broke it. You changed the decode to "String", but the filter policy requires that it be scoped, and thus any unscoped values are removed. Change it back and it will work. If your metadata is correct, anyway.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net