No attributes are getting passed to SP from my IdP
Peter Schober
peter.schober at univie.ac.at
Mon Mar 18 06:57:30 EDT 2013
* lalithj <j_lalith at hotmail.com> [2013-03-18 11:40]:
> Does this mean as it stands now, there is no meaning for
> <RequestedAttribute ..... tag in SP meta data,
>
> and
>
> atrribute-filter file is the only way to achive this ?
Yes, unless you do the very simple work of adding the plugin + config
that enable that, as per the link I sent before.
> Other interesting thing is, we are connected to a external
> federation and we dont have any filter policies defined for them,
> the meta data pushed by federation(kept in our IdP) got many entity
> IDs (SPs) with RequestedAttribute defined,
No idea what an "external federation" is (or what most of the above
means, really).
Note that often you don't configure attribute release policies to a
"federation", as that fails the principle of minimum disclosure
(assuming not all SPs in the federation require the exact same set of
data in order to work).
> Not sure how they achieve it (params), because we know we are
> passing attributes to them without any filter policies defined for
> them.
The Shibboleth software does /not/ release any attributes to any SP by
default, so what you're saying is pretty much impossible (based on a
Shib 2.3.8 IdP without the plugin from uApprove added to the IdP, plus
necessary filter configuration to release attributes based on
requested attributes in SAML2.0 metadata, and no explicit filter rules
set in attribute-filter either).
If you're sending them attribute you must have filter rules in place
that cause that. It also cannot be "achieved" by "them". Noone but you
can influence attribute release (without you using the
AttributeInMetadata plugin),
-peter
More information about the users
mailing list