SP: making a saml attribute out of a header
Marc Boorshtein
mboorshtein at gmail.com
Thu Sep 27 15:26:53 EDT 2012
All,
I feel like I am missing something very basic here. I can't seem to
get a SAML attribute or the NameID into a header in my shib SP.
Shib: sp-2.5
apache 2.2
here's the assertion:
<saml2p:Response ID="f6066a7a53a19ea1a57e126229204f96043cc5505"
IssueInstant="2012-09-27T19:20:34.634Z"
Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
>
<saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.sp.com:9443/auth/idp/ShibProxy</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</saml2p:Status>
<saml2:Assertion ID="f8a44954e8fc4f76f0811d52746c2cd0109c42a00"
IssueInstant="2012-09-27T19:20:34.634Z"
Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
>
<saml2:Issuer>https://idp.sp.com:9443/auth/idp/ShibProxy</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
/>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
/>
<ds:Reference URI="#f8a44954e8fc4f76f0811d52746c2cd0109c42a00"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
>
<ds:Transforms
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
/>
<ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
>
<ec:InclusiveNamespaces PrefixList="ds saml2 xs"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
/>
<ds:DigestValue
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">UHxXDJ9fIXthRYNG0FaXGFkUq4A=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
OgC6kyfcJ5yB08E2S51et+IQAvx06mQbQgdp21EACEzfX/mrNDElAs92uAUWMBJODjNbIA8UMa1r
Jy3vx/fE/q1ivdqKIrQmLG1cvSlxbpQ4czUvvhsAF5IVKmEP1M/Tt4C+me7NxSywO/aBx2TPNqZf
ghOvc4OhQQyoKt+b8cY=
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIICeTCCAeKgAwIBAgIGATnGL2KlMA0GCSqGSIb3DQEBBQUAMGMxCzAJBgNVBAYTAnVzMQswCQYD
VQQIEwJkYzETMBEGA1UEBxMKd2FzaGluZ3RvbjEMMAoGA1UEChMDZG9zMQwwCgYDVQQLEwNzaW8x
FjAUBgNVBAMTDWlkcC1zYW1sMi1zaWcwHhcNMTIwOTE0MTkwOTE3WhcNMjIwOTEyMTkwOTE3WjBj
MQswCQYDVQQGEwJ1czELMAkGA1UECBMCZGMxEzARBgNVBAcTCndhc2hpbmd0b24xDDAKBgNVBAoT
A2RvczEMMAoGA1UECxMDc2lvMRYwFAYDVQQDEw1pZHAtc2FtbDItc2lnMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQC2qnDymqKSBoOaQLST4ZGtPauVLI0VYMK+1UCcEnpVcOxlZKn7a2wLGBi3
V2qf+9O+yBxNHqmda++2UwKfrQfuOXTD+GqBb9X3Mo62mRU2aH15xtb0PnKKtfvW88c5bMEcpWkR
M+tITGqunoRV63bfOdP8epgdTI5B5CN29Yt1NwIDAQABozgwNjAMBgNVHRMBAf8EAjAAMA4GA1Ud
DwEB/wQEAwIFoDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOBgQBj0sUs
R4000W0y91XHCylSxqz+AEqgGrxT79Llhde7WfrvwkgMY4x4+X6eOhiDrA6ByzkYpR1dSvGXWEHF
RZVhhg7CTlgshKgKpO0q/Q7rZYpN9/spiP64SLu2w6A8SQwAO4tW9jIMHTqymO95xZL4fwgtwP1W
1eZN1XifgxiKgg==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">jjackson</saml2:NameID>
<saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData
NotOnOrAfter="2012-09-27T19:25:34.634Z"
Recipient="http://app.sp.com:8080/Shibboleth.sso/SAML2/POST"
/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2012-09-27T19:15:34.634Z"
NotOnOrAfter="2012-09-27T19:25:34.634Z"
>
<saml2:AudienceRestriction>
<saml2:Audience>https://app.sp.com/</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2012-09-27T19:20:34.634Z"
SessionIndex="f8a44954e8fc4f76f0811d52746c2cd0109c42a00"
>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute
Name="urn:mace:dir:attribute-def:eduPersonPrincipalName">
<saml2:AttributeValue
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string"
>jjackson</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>
here's what i see in shibd.log:
2012-09-27 15:20:36 WARN Shibboleth.AttributeDecoder.Scoped [1]:
ignoring unscoped AttributeValue
2012-09-27 15:20:36 INFO Shibboleth.AttributeExtractor.XML [1]:
skipping unmapped SAML 2.0 Attribute with Name:
urn:mace:dir:attribute-def:eduPersonPrincipalName,
Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
2012-09-27 15:20:36 INFO Shibboleth.SessionCache [1]: new session
created: ID (_7d37ebead9e207f19306dc47db760e31) IdP
(https://idp.state.gov:9443/auth/idp/ShibProxy)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (192.168.122.1)
Here's what I have for headers:
AUTH_TYPE="shibboleth"
DOCUMENT_ROOT="/home/shib/httpd/htdocs"
GATEWAY_INTERFACE="CGI/1.1"
HTTP_ACCEPT="text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
HTTP_ACCEPT_ENCODING="gzip, deflate"
HTTP_ACCEPT_LANGUAGE="en-us,en;q=0.5"
HTTP_CONNECTION="keep-alive"
HTTP_COOKIE="_shibsession_64656661756c7468747470733a2f2f6573657276696365732e73746174652e676f762f=_7d37ebead9e207f19306dc47db760e31"
HTTP_HOST="app.sp.com:8080"
HTTP_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64; rv:15.0)
Gecko/20100101 Firefox/15.0.1"
PATH="/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/shib/bin"
QUERY_STRING=""
REMOTE_ADDR="192.168.122.1"
REMOTE_PORT="36741"
REQUEST_METHOD="GET"
REQUEST_URI="/cgi-bin/printenv"
SCRIPT_FILENAME="/home/shib/httpd/cgi-bin/printenv"
SCRIPT_NAME="/cgi-bin/printenv"
SERVER_ADDR="192.168.122.154"
SERVER_ADMIN="you at example.com"
SERVER_NAME="app.sp.com"
SERVER_PORT="8080"
SERVER_PROTOCOL="HTTP/1.1"
SERVER_SIGNATURE=""
SERVER_SOFTWARE="Apache/2.2.23 (Unix) mod_ssl/2.2.23 OpenSSL/1.0.0-fips"
Shib_Application_ID="default"
Shib_Authentication_Instant="2012-09-27T19:20:34.634Z"
Shib_Authentication_Method="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
Shib_AuthnContext_Class="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
Shib_Identity_Provider="https://idp.state.gov:9443/auth/idp/ShibProxy"
Shib_Session_ID="_7d37ebead9e207f19306dc47db760e31"
Shib_Session_Index="f8a44954e8fc4f76f0811d52746c2cd0109c42a00"
Am I missing something??
Thanks
Marc
More information about the users
mailing list