Attributes retrieved from database are not getting resolved

[Achugatla, Vijay Kumar (ELS-CON)]

I am trying to deploy latest SP 2.4 and IDP 2.3.6 and while testing them I am facing some issues with resolving attributes

Issue 1: Attributes retrieved from database are not getting resolved

Below is my ResolverRDBMSDataConnector

    <resolver:DataConnector id="MyDB " xsi:type="dc:RelationalDatabase">
        <dc:ApplicationManagedConnection jdbcDriver="oracle.jdbc.driver.OracleDriver"
                                         jdbcURL="jdbc:oracle:thin:@//CPDB1123:1521/TestDB"
                                         jdbcUserName="TestUser"
                                         jdbcPassword="TestPassword" />
        <dc:QueryTemplate>
            <![CDATA[
                SELECT edupersonentitlement, edupersontargetedid FROM shibboleth_attributes WHERE edupersonprincipalname = '$requestContext.principalName'
            ]]>
        </dc:QueryTemplate>

        <dc:Column columnName="edupersonentitlement" attributeID="eduPersonEntitlement" />
        <dc:Column columnName="edupersontargetedid" attributeID="eduPersonTargetedID" />

Sample values from the DB
edupersonentitlement = TestEntitlement
edupersontargetedid = 8a8456a2lj78jhaf089

Attribute definitions

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="eduPersonEntitlement" sourceAttributeID="eduPersonEntitlement">
        <resolver:Dependency ref="MyDB" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:eduPersonEntitlement" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" friendlyName="eduPersonEntitlement" />
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Script" id="eduPersonTargetedID">
        <resolver:Dependency ref="MyDB" />
        <resolver:AttributeEncoder xsi:type=" enc:SAML2String " name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
        <ad:Script>
            <![CDATA[
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);

if (eduPersonTargetedID != null) {
    eduPersonTargetedID = eduPersonTargetedID + "@idp1-cert";
}
          ]]>
          </ad:Script>
    </resolver:AttributeDefinition>

Below is from the IDP process log

DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.RDBMSDataConnector:323] -
RDBMS data connector MyDB - Querying database for attributes with query SELECT edupersonentitlement, edupersontargetedid FROM shibboleth_attributes WHERE edupersonprincipalname = 'Test_User'
DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.RDBMSDataConnector:332] -  RDBMS data connector MyDB - Retrieved attributes: [EDUPERSONTARGETEDID, EDUPERSONENTITLEMENT]

DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute eduPersonEntitlement for principal Test_User
DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute eduPersonEntitlement containing 0 values
DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute eduPersonTargetedID for principal Test_User
DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute eduPersonTargetedID containing 0 values

Is there anything wrong with my configuration. I am not understanding why the attributes are not getting resolved

Issue 2: AttributeDecoder formatter is stripping off a part of eduPersonTargetedID value

Since my IDP is not resolving the attributes retrieved from database, I hardcoded the eduPersonTargetedID to see how is it coming at SP side. I hardcoded it to 8a8456a2lj78jhaf089 at Test-IDP

IDP process log

      <saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">8a8456a2lj78jhaf089 at Test-IDP</saml2:AttributeValue>
      </saml2:Attribute>

SP log

<saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">8a8456a2lj78jhaf089 at Test-IDP</saml2:AttributeValue></saml2:Attribute>

But when this attribute is passed as http header to my application that value is coming differently. Somehow the @Test-IDP portion is stripped off
Shib-TargetedID Value: [4a453a2a0107c3f1fb4f]

>From attribute-map.xml

    <Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement" id="entitlement"/>
    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="entitlement"/>
    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="Shib-TargetedID">
        <AttributeDecoder xsi:type="NameIDFromScopedAttributeDecoder" formatter="$Name" defaultQualifiers="true"/>
    </Attribute>

>From attribute-policy.xml

        <afp:AttributeRule attributeID="Shib-TargetedID">
            <afp:PermitValueRule xsi:type="basic:NOT">
                <basic:Rule xsi:type="basic:AttributeIssuerRegex" regex="@"/>
            </afp:PermitValueRule>
        </afp:AttributeRule>

Please let me know if you have any suggestions on how to handle these two issues?

Thanks,
Vijay



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120330/969b8424/attachment-0001.html