Filtering for EntityAttributes does not work (SP 2.5)
Richard M. Zahoransky
richard.zahoransky at rz.uni-freiburg.de
Thu Nov 29 10:33:14 EST 2012
Hello list,
at our university we are using shibboleth. We are planning updating to
SP version 2.5 because we see a need for Entity-Attributes. On the SP we
want to whitelist IdP which have a certain EntityAttribute. The others
should be ignored.
In shibboleth2.xml I enabled a whitelist filter with EntityAttributes
matcher. I also updatet the metadata so that they hold the needed
attributes.
However, shibd says it drops every entity because it is not whitelisted.
I have tried the following inside shibboleth2.xml:
<MetadataProvider type="XML" file="filtertest.xml">
<MetadataFilter type="Whitelist" matcher="EntityAttributes">
<saml:Attribute Name="http://url/attribute/entity/category"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>http://url/category/ourcategory</saml:AttributeValue>
</saml:Attribute>
</MetadataFilter>
</MetadataProvider>
and inside the metadata I have:
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="https://ouridp/idp/shibboleth"xmlns:ds=...>
<IDPSSODescriptor
protocolSupportEnumeration=...>
<Extensions>
<shibmd:Scope regexp="false">uni-freiburg.de</shibmd:Scope>
<mdattr:EntityAttributes
xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
<saml:Attribute
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
Name="http://url/attribute/entity/category">
<saml:AttributeValue>http://url/category/ourcategory</saml:AttributeValue>
</saml:Attribute>
</md:EntityAttributes>
</Extensions>
...
shibd-log:
2012-11-29 14:07:15 INFO OpenSAML.MetadataProvider.XML : loaded XML
resource (filtertest.xml)
2012-11-29 14:07:15 INFO OpenSAML.Metadata : applying metadata filter
(Whitelist)
...
2012-11-29 14:07:15 INFO OpenSAML.MetadataFilter.Whitelist : filtering
out non-whitelisted entity (https://ouridp/idp/shibboleth)
can someone please provide some help/feedback?
Greetings,
Richard
More information about the users
mailing list