Removed value at position (0) of attribute ??

[Saurabh Tyagi]

Thanks Peter.!!

I added "xmlns="urn:mace:shibboleth:metadata:1.0": in IdP's metedata.
But that did,t work. As I was unable to understand the default
attribute-policy.xml.

But removing the rules workd.
But yes. I have to add the rules later on.
As currently I am in testing environment.

If u could provide any link that can exapling how to read or understand
these rules.



Thanks and Regards
Saurabh Tyagi

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Peter Schober
Sent: Friday, July 12, 2013 1:30 PM
To: users at shibboleth.net
Subject: Re: Removed value at position (0) of attribute ??

* Saurabh Tyagi <saurabh.tyagi at thepsi.com> [2013-07-12 09:14]:
> Why it is removing values?

The default attribute-policy.xml has rules to enforce that only
authorized IDPs can assert scoped attributes like (and pretty much
limited to) eduPersonPrincipanName and affiliations).

So you can either disable these rules (and run the risk of one IdP
impersonating someone else's scopes in those scoped attributes, which
might be small or noneistent, esp if your SP only knows a single IdP
via SAML metadata) or add the required extension element to the IdP's
SAML metadata.

For the latter see
https://wiki.shibboleth.net/confluence/display/SC/ShibMetaExt+V1.0
for details.

Basically you change the metadata you have on disk for that IdP by
adding something like the following as a child element of the
Extensions child element of the IDPSSODescriptor, e.g.:

  <Scope xmlns="urn:mace:shibboleth:metadata:1.0"
regexp="false">contoso.com</Scope>

Makeing it look something like this:

<EntityDescriptor entityID=youridp>
  <IDPSSODescriptor ...>
    <Extensions>
      <Scope xmlns=...> as above
    </Extensions>
    (other stuff)
  </IDPSSODescriptor>
  (more other stuff)
</EntityDescriptor>

The wiki page above has the authoritative details, if in doubt.
-peter
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net