Is this a metadata error?

[David Gersic]

>>> On 5/23/2013 at 11:12 AM, Ian Young <ian at iay.org.uk> wrote: 

> On 23 May 2013, at 17:03, "David Gersic" <dgersic at niu.edu> wrote:
> 
>> I could be wrong, but I think that's where this is going wrong. The metadata 
> should have "https://niu.universitytickets.com" in it, not 
> "https://NIU.UniversityTickets.com".
>> 
>> Right?
> 
> The location the the SP tells the IdP to return the response to needs to 
> match exactly the location described in the metadata. 

Thanks. I've gotten them to fix this in the metadata, and it seems to have helped. At least now the browser is getting back to the SP. Now I've got a new problem. I think I've figured it out, but I'd appreciate confirmation of my suspicions.

After the basic authentication at the IdP is complete, I'm forwarded back to the SP, which is trying to do a basic page display of attributes. At the browser, I'm seeing this as:


UID: xxxxxxx at niu.eduError: EDUPERSONPRIMARYAFFILIATION not sent for your username


This appears to be the eduPersonPrincipalName (xxxxxxx at niu.edu), and probably that the SP request for eduPersonPrimaryAffiliation didn't work.

Looking at the attribute-filter.xml, I have:


    <!--  Release eduPerson attributes to Incommon.Org federation  -->
    <afp:AttributeFilterPolicy id="releaseToIncommonDotOrg">
        <afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterInEntityGroup" groupID="urn:incommon.org"/>

        <afp:AttributeRule attributeID="eduPersonAffiliation">
            <afp:PermitValueRule xsi:type="basic:OR">
                <basic:Rule xsi:type="basic:AttributeValueString" value="faculty" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="student" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="staff" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="alum" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="member" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="affiliate" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="employee" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="library-walk-in" ignoreCase="true" />
            </afp:PermitValueRule>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonPrimaryAffiliation">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonEntitlement">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>


which I *think* means that I'm releasing these attributes to any SP defined in the InCommon metadata. I release ePPN to anybody.

Looking in the metadata, I see this SP defined, but I see what looks to me like an error here:


    <AttributeConsumingService xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" index="1">
      <ServiceName xml:lang="en">UniversityTickets SSO</ServiceName>
      <RequestedAttribute FriendlyName="cn" Name="urn:mace:dir:attribute-def:cn" NameFormat="urn:mace:shibbole
th:1.0:attributeNamespace:uri"/>
      <RequestedAttribute FriendlyName="cn" Name="urn:oid:2.5.4.3" NameFormat="urn:oasis:names:tc:SAML:2.0:att
rname-format:uri"/>
      <RequestedAttribute FriendlyName="eduPersonAffiliation" Name="urn:mace:dir:attribute-def:eduPersonAffili
ation" NameFormat="urn:mace:shibboleth:1.0:attributeNamespace:uri"/>
      <RequestedAttribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameForm
at="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>
      <RequestedAttribute FriendlyName="mail" Name="urn:mace:dir:attribute-def:mail" NameFormat="urn:mace:shib
boleth:1.0:attributeNamespace:uri"/>
      <RequestedAttribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:n
ames:tc:SAML:2.0:attrname-format:uri"/>
    </AttributeConsumingService>


If I'm reading this correctly, the SP defined in the metadata expects to get cn, eduPersonAffiliation, and mail. It doesn't mention eduPersonPrimaryAffiliation, so it doesn't get ePPA, which is why it can't display ePPA at the test page.

Right?