Problem releasing uid attribute from IDP to SP

Peter Schober peter.schober at univie.ac.at
Tue Nov 26 09:25:09 EST 2013


* Armando Martins <armando.mart1s at gmail.com> [2013-11-26 15:15]:
> 14:27:13.856 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546]
> - Removing attribute uid, it can not be encoded via
> edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder

That's just DEBUG, so nothing to worry about per se (it would be WARN
or ERROR otherwise).

> And in my SP logs :
> 
> 2013-11-26 14:27:15 INFO Shibboleth.AttributeExtractor.XML [5]: skipping
> unmapped SAML 2.0 Attribute with Name: urn:oid:0.9.2342.19200300.100.1.1

That's good as that means the IDP has properly encoded and sent uid as
an attribute.
To make the attribute available you'll need to literally do what the
message says is missing:

<Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/>

> I don't understand why i can't view my uid on Shibboleth.SSO/Session
> SP's..... but i can view all my others attributes....

The SP told you above.

> SP attribute map file about uid :
> 
> <Attribute name="urn:oid:0.9.2342.19200300.100.1.10" id="uid"/>

That's mapping a different attribute to "uid", one that (a) does not
represent "uid" (but "manager") and more importantly one with a
different OID (note the 0 at the end) which is why the SP said that
urn:oid:0.9.2342.19200300.100.1.1 was unmapped (because it still is).
-peter


More information about the users mailing list