Shibboleth SP - Using NameID with "unspecified" format.

[Friedrich Clausen]

Hello All,

We are interoperating with an AD FS implementation and it is sending along
a NameID that is not being mapped to an attribute with our standard
attribute-map.xml. The following is shown in the shibd.log set to debug
(removed timestamps for readability)

Shibboleth.AttributeExtractor.XML [2]: unable to extract attributes,
unknown XML object type: samlp:Response
Shibboleth.AttributeExtractor.XML [2]: skipping unmapped NameID with format
(urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified)
Shibboleth.AttributeExtractor.XML [2]: unable to extract attributes,
unknown XML object type:
{urn:oasis:names:tc:SAML:2.0:assertion}AuthnStatement

It appears, due to the "samlp" message, that the AD FS "IdP" is using SAML
1.1.  The above results in no attributes visible to the application. I then
decided, as an experiment, to add the
"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" to
attribute-map.xml as a simple mapping with no decoder specified -

    <Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
id="test-mapping">
    </Attribute>

I reloaded shibd and then the test attribute, "test-mapping", was visible.
The logs showed

Shibboleth.AttributeExtractor.XML [2]: unable to extract attributes,
unknown XML object type: samlp:Response
Shibboleth.AttributeDecoder.String [2]: decoding SimpleAttribute
(test-mapping) from SAML 2 NameID with Format (unspecified)
Shibboleth.AttributeExtractor.XML [2]: unable to extract attributes,
unknown XML object type:
{urn:oasis:names:tc:SAML:2.0:assertion}AuthnStatement

This solves my problem (getting the user name visible to the app). My
question is - is this a recommended approach? Should I, or the AD FS
administrators, do something differently?

Many thanks,

Fred.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130722/95bd1aa0/attachment.html