help with first-time SP not releasing attributes/eppn

[Rob Gorrell]

So, admittedly being very much new to the world of SP's and trying to set
up my own, learning as I go... I'm struggling to troubleshoot why I can't
release attributes (mainly eppn). I've attempted to trace from left to
right whats going on and I'm pretty confident my IdP is appropriately
releasing the attribute with a value in it. But when I get over to the SP,
that is where what little experience I have leaves me and i'm at a loss. My
understanding is the attribute-map is supposed to control this, but by all
accounts, I've married up the attribute definition there to match eppn. But
logs, php test script, and shibboleth.sso/session all show me nothing. I
was hoping someone with more SP experience might be able to follow my
though process here and tell me what I've failed to check and where things
might still go wrong. I'd appreciate any learning experience here you can
teach me...

Thanks
-Rob

*
IDP's attribute definition for eppn:*
   <resolver:AttributeDefinition id="eduPersonPrincipalName"
xsi:type="Scoped"
      xmlns="urn:mace:shibboleth:2.0:resolver:ad" scope="uncg.edu">
      <resolver:Dependency ref="scriptUserName" />
      <resolver:AttributeEncoder xsi:type="SAML1ScopedString"
         xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:mace:dir:attribute-def:eduPersonPrincipalName" />
      <resolver:AttributeEncoder xsi:type="SAML2ScopedString"
         xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
         friendlyName="eduPersonPrincipalName" />
   </resolver:AttributeDefinition>

*IDP's filter releasing eppn..**.*
   <AttributeFilterPolicy id="GrouperSSO">
         <PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="https://dlx-grouperui.uncg.edu/shibboleth" />
         <AttributeRule attributeID="eduPersonPrincipalName">
               <PermitValueRule xsi:type="basic:ANY" />
         </AttributeRule>
   </AttributeFilterPolicy>
*
IDP process log showing my DataConnector was able to obtain a value for
eppn and matched it to my filter:*
09:52:06.868 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute eduPersonPrincipalName containing 1 value
09:52:06.878 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:131]
- Filter policy GrouperSSO is active for principal rwgorrel
09:52:06.878 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:156]
- Processing permit value rule for attribute eduPersonPrincipalName for
principal rwgorrel

*IDP audit log entry showing eppn was released:*
20130510T125726Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_0ab26240858780515a59e91adfccde8a|
https://dlx-grouperui.uncg.edu/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp-d.uncg.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8a614609d06b27373e13ebcc6f3234e8|rwgorrel|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
*|*
eduPersonPrincipalName,transientId,eduPersonTargetedID,||_154e18d723e1e467dc44e8ddf2774538,|

*SP's attribute map mapping eppn:*
    <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName"
id="eppn">
        <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
    </Attribute>
    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">
        <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
    </Attribute>

*SP's shibboleth2.xml*
    <ApplicationDefaults id="default" policyId="default"
                         entityID="https://dlx-grouperui.uncg.edu/shibboleth
"
                         REMOTE_USER="eppn persistent-id targeted-id"
                         signing="false" encryption="false">

*SP's transaction.log showing only persistent-id coming through:*
2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]: New session (ID:
_eb7997afba33868972604b5a956ce1f7) with (applicationId: default) for
principal from (IdP: https://idp-d.uncg.edu/idp/shibboleth) at
(ClientAddress: 10.80.200.134) with (NameIdentifier:
_facc00094d6a9cfa510f3d03e59d32d6) using (Protocol:
urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID:
_154e18d723e1e467dc44e8ddf2774538)
2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]: Cached the following
attributes with session (ID: _eb7997afba33868972604b5a956ce1f7) for
(applicationId: default) {
2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]:   persistent-id (1
values)
2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]: }


What gives?! Where's it getting lost/dropped?


-- 
Robert W. Gorrell
Middleware Engineer, Identity and Access Management
University of NC at Greensboro
336-334-5954
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130510/d32dc6fa/attachment.html