RequestedAttributes in SP metada

[Nick Amon]

Hi,

The Amazon SP metadata originally contained the following:

<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
   <md:AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://signin.aws.amazon.com/saml">
      <ServiceName xml:lang="en">AWS Management Console Single Sign-On</ServiceName>
      <RequestedAttribute isRequired="true" name="https://aws.amazon.com/SAML/Attributes/Role" FriendlyName="RoleEntitlement"/>
      <RequestedAttribute isRequired="true" name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" FriendlyName="RoleSessionName"/>
      <RequestedAttribute isRequired="false" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"/>
</md:AssertionConsumerService>

After successful authentication, I noticed this in the logs:
20:20:51.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal XXX were not requested, resolving all attributes.

As if the AttributeResolver did not recognize that the SP's RequestedAttribute.  I thought that this was caused by AWS not conforming to the SAML standard since I couldn't find an example of including RequestedAttribute elements inside AssertionConsumerService elements.

I thus modified the metadata to conform to the standard as I have understood it:
  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
    <md:AttributeConsumingService index="1">
      <ServiceName xml:lang="en">AWS Management Console Single Sign-On</ServiceName>
      <RequestedAttribute isRequired="true" name="https://aws.amazon.com/SAML/Attributes/Role" FriendlyName="RoleEntitlement"/>
      <RequestedAttribute isRequired="true" name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" FriendlyName="RoleSessionName"/>
      <RequestedAttribute isRequired="false" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"/>
    </md:AttributeConsumingService>
....
This didn't work either; I received the exact same message.  I therefore looked at the code and it appears it is looking for requested attributes in the AttributeAuthorityDescriptor element.  What am I missing?  I would like the IdP to recognize the attributes requested by the SP, ideally in the AssertionConsumerService element so I don't have to modify the provided metadata, or at the least AttributeConsumingService.

Thanks,

Nicholas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131224/3eb74a20/attachment-0001.html