Attribute resolver dependency question/issue

[Chad La Joie]

You must specify both.  The source attribute ID indicates which
attribute out of the potentially many a given set of dependencies
might return.  Dependencies say which resolver plugins you want
providing that data.

There is a current limitation in the v2 resolver (addressed in v3)
that the source attribute ID must be the same across all dependencies.

On Wed, May 2, 2012 at 2:24 PM, Tom Poage <tfpoage at ucdavis.edu> wrote:
> Greetings,
>
> Ran across an issue where an attribute (eduPersonScopedAffiliation) is
> released on some authentications (first log line below) and not others
> (second line). IdP 2.3.3. Log lines from same server.
>
>> 06:36:48.187 - INFO [Shibboleth-Audit:970] - 20120502T133648Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_7e52370bd1ae8de4417fbd797f989447|https://XXX.edu/|urn:mace:shibboleth:2.0:profiles:saml2:sso|urn:mace:incommon:ucdavis.edu|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_885fefeb71e10800b71b2d201f4e5a81|loginid|urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified|eduPersonPrincipalName,transientId,surname,eduPersonScopedAffiliation,givenName,email,displayName,|DE22T...||
>> 06:38:35.263 - INFO [Shibboleth-Audit:970] - 20120502T133835Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_7ab58a59dbde89e01c811b7bb41ba47f|https://XXX.edu/|urn:mace:shibboleth:2.0:profiles:saml2:sso|urn:mace:incommon:ucdavis.edu|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_873e17b5ab439c0bcd23bffbe9cb76f1|loginid|urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified|eduPersonPrincipalName,transientId,surname,givenName,email,displayName,|OTN2TTF...||
>
> Our eduPersonAffiliation is stored in LDAP, but not scoped affiliation;
> ePSA relies on ePA.
>
> I had assumed specifying sourceAttributeID creates an implicit
> dependency to the source attribute, so the dependency in ePSA on the
> directory is not strictly required.
>
> Question: should ePSA <resolver:Dependency> (specifics below) list the
> dependent attribute identifier rather than the LDAP connector?
>
> Can't seem to recreate with aacli.sh
>
> Thanks!
> Tom.
>
> attribute-resolver.xml ePSA:
>
>>     <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonScopedAffiliation" scope="ucdavis.edu" sourceAttributeID="eduPersonAffiliation">
>>         <resolver:Dependency ref="ucdLDAP" />
>>         <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" />
>>         <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation" />
>>     </resolver:AttributeDefinition>
>
> ... and add "member" value to ePA (if it contains any other value):
>
>>     <resolver:AttributeDefinition id="eduPersonAffiliation" xsi:type="ad:Script" sourceAttributeID="eduPersonAffiliation">
>>         <resolver:Dependency ref="ucdLDAP" />
>>         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:eduPersonAffiliation" />
>>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" friendlyName="eduPersonAffiliation" />
>>         <ad:Script><![CDATA[
>>              importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
>>              if (eduPersonAffiliation == null) {
>>                  eduPersonAffiliation = new BasicAttribute("eduPersonAffiliation");
>>              }
>>              if (eduPersonAffiliation.getValues().isEmpty() == false) {
>>                  eduPersonAffiliation.getValues().add("member");
>>              }
>>         ]]></ad:Script>
>>     </resolver:AttributeDefinition>
>
> And then filter out non-standard (internal legacy) values:
>
>>     <!-- Filter out non-standard attribute values -->
>>     <afp:AttributeFilterPolicy id="noRelease">
>>         <afp:PolicyRequirementRule xsi:type="basic:ANY" />
>>         <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
>>             <afp:DenyValueRule xsi:type="basic:AttributeValueString" value="external at ucdavis.edu" ignoreCase="true" />
>>         </afp:AttributeRule>
>>         <afp:AttributeRule attributeID="eduPersonAffiliation">
>>             <afp:DenyValueRule xsi:type="basic:AttributeValueString" value="external" ignoreCase="true" />
>>         </afp:AttributeRule>
>>     </afp:AttributeFilterPolicy>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered