employeeNumber attribute

[Christopher Bongaarts]

On 9/11/2012 12:35 PM, Christopher J. Bottaro wrote:
> I turned the log level to debug.  Below is (what I think is) the
> relevant snippet:
>
> 2012-09-11 17:25:38 DEBUG Shibboleth.AttributeExtractor.XML [2]:
> skipping unmapped NameID with format
> (urn:oasis:names:tc:SAML:2.0:nameid-format:transient)
> 2012-09-11 17:25:38 INFO Shibboleth.AttributeExtractor.XML [2]: skipping
> unmapped SAML 2.0 Attribute with Name: urn:oid:0.9.2342.19200300.100.1.1
>
> So it looks like they are pushing NameID, which we are not setup to
> receive.  That's fine I guess.
>
> Curious though, I don't see anywhere in the log where they are pushing
> attributes that we *are* accepting.

urn:oid:0.9.2342.19200300.100.1.1 is the SAML 2 name for "uid".  I think 
employeeNumber is represented as "urn:oid:2.16.840.1.113730.3.1.3" (at 
least that's what we use).

> Also, employeeNumber is nowhere to be seen in the logs.

Unless they are passing it in the uid field you're not mapping.

You might find it helpful as well to hit /Shibboleth.sso/Session after 
logging in, to see what attributes were received (and you can tweak 
shibboleth2.xml to show the values instead of a count if you want).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%