graph IDP activity with cacti / rrdtools

[procaccia]

On 05/10/2012 07:20 PM, Cantor, Scott wrote:
>> what attributes the shibboleth wiki is expecting ?
>>      
> There should be a link to that information in the error page it should
> give you when you try it.
Right, there's a link !
I managed to connect and contribute a child page from Peter's log 
analysis tool:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdP+Audit+Log+Cacti+Graph

Regarding the login to the wiki, here's what I went through
from 
https://wiki.shibboleth.net/confluence/display/DEV/Infrastructure+Information
I realize that the following attributes a required
eduPersonTargetedID or eduPersonPrincipalName displayName and mail

A first try with releasing eduPersonPrincipalName displayName and mail 
to entityID https://wiki.shibboleth.net/shibboleth failed ! probably 
because of an obscure encoding eppn problem !?

23:50:41.184 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:735] 
- Building assertion NameID for principal/relying 
party:procacci/https://wiki.shibboleth.net/shibboleth
23:50:41.184 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:774] 
- SP-supported name formats: [urn:mace:shibboleth:1.0:nameIdentifier]
23:50:41.185 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:801] 
- No attributes for principal procacci support an encoding into a 
supported name ID format.

although my attribute resolver does contain for AttributeDefinition 
id="eduPersonPrincipalName"

<resolver:AttributeEncoder xsi:type="SAML1ScopedString" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
             name="urn:mace:dir:attribute-def:eduPersonPrincipalName" />

<resolver:AttributeEncoder xsi:type="SAML2ScopedString" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
             name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" 
friendlyName="eduPersonPrincipalName" />

Anyway, I finally connected to the wiki by releasing also 
eduPersonTargetedID
which ended my IDP to release these:
eduPersonPrincipalName,supannEtablissement,transientId,eduPersonTargetedID,email,displayName

 From there, I've been able to connect .