Shibboleth IDP and ADFS federation claim problem

[Renzo De Renzi]

Il giorno 07/ott/2012, alle ore 20:31, Cantor, Scott ha scritto:

> There are few similarities between the very standards-based SAML attribute
> profiles used by Shibboleth and the proprietary, often fundamentally
> incorrect, approaches to attribute naming used by ADFS. If you want to use
> ADFS as an SP, you have to adjust the IdP or the ADFS side to use one or
> the other, and that can be very complex on the ADFS side.
> 
> Some of this is discussed in the wiki in the CommercialInterop topic.
> 
> You have to start by determining how you intend to name attributes in SAML
> and work from that to what configuration changes are needed.
> 
> If you follow up with some information on what attributes you want to
> exchange, and then which end you want to adjust, then there are more
> specific examples available.
> 
> -- Scott

Thanks for your prompt answer, this is my policy taken from attribute-filter-xml file, it already works correctly between Shibboleth IDP and SP on the same machine:

<!-- my policy -->
    <afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="givenName">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="surname">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="organizationalUnitName">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="uid">
                <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>