attributes released to InCommon R&S category SPs

[Brian Gibson]

Hi all,

I am trying to connect our IdP (v2.4) server to InCommon's R&S Category 
of SPs and I can log into their test GENI Experimenter Portal  URL here

https://portal.geni.net/secure/env.php

and I can also log into the test InCommon SP here

https://service1.internet2.edu/test/

One thing I noticed though, both give status pages for what attributes 
were received and both display my eduPersonPrincipalName correctly but 
they are not showing other attributes that I configured to be released 
like sn, givenName, mail etc.... I am not sure if that is by design 
(they just don't bother showing it)... or they are not receiving these 
attributes at all. The changes I made to the attribute-filter.xml file 
are as follows and I followed the directions in this URL 
https://spaces.internet2.edu/display/InCFederation/Configure+a+Shibboleth+IdP+to+Release+Directory+Info

<afp:AttributeFilterPolicy id="releaseToAnySP">
           <afp:PolicyRequirementRule xsi:type="basic:ANY"/>

           <afp:AttributeRule attributeID="eduPersonPrincipalName">
                 <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="email">
                 <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="displayName">
                 <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="givenName">
                 <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
           <afp:AttributeRule attributeID="surname">
                 <afp:PermitValueRule xsi:type="basic:ANY"/>
           </afp:AttributeRule>
     </afp:AttributeFilterPolicy>


The only other thing I could think of is if the attribute-resolver.xml 
file isn't pulling the right attributes from Active Directory (you can't 
release what you don't have). There are entries in the 
attribute-resolver.xml file for all the attributes that are not 
appearing ... for example..

<resolver:AttributeDefinition xsi:type="ad:Simple" id="*email*" 
sourceAttributeID="*mail*">
         <resolver:Dependency ref="*myLDAP*" />
         <resolver:AttributeEncoder xsi:type="enc:SAML1String" 
name="urn:mace:dir:attribute-def:mail" />
         <resolver:AttributeEncoder xsi:type="enc:SAML2String" 
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
     </resolver:AttributeDefinition>

and .....

<resolver:AttributeDefinition xsi:type="ad:Simple" id="*surname*" 
sourceAttributeID="*sn*">
         <resolver:Dependency ref="*myLDAP*" />
         <resolver:AttributeEncoder xsi:type="enc:SAML1String" 
name="urn:mace:dir:attribute-def:sn" />
         <resolver:AttributeEncoder xsi:type="enc:SAML2String" 
name="urn:oid:2.5.4.4" friendlyName="sn" />
     </resolver:AttributeDefinition>

but I think my LDAP connector might be filtering out everything except 
the sAMAccountName (which is used to build the eduPersonPrincipalName 
attribute)... here is the section of that file that names and 
establishes my LDAP connection to Active Directory


  <!-- LDAP Connector - just attach to the AD LDAP -->
     <resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" 
xmlns="urn:mace:shibboleth:2.0:resolver:dc"
         useStartTLS="/[our-TLS-setting]/"
         ldapURL="ldap:///[our-AD-server]/:/[our-port-number]/" 
baseDN="/[our base DN]/" principal="/[our-user]/@wheatonma.edu"
         principalCredential="/[service-account-password]/">
*<FilterTemplate>**
**            <![CDATA[**
**(sAMAccountName=$requestContext.principalName)**
**            ]]>**
**        </FilterTemplate>*

         <!-- We rely on the uniqueness of the objectSid.  But it is 
binary so we *must* make it so -->
         <LDAPProperty name="java.naming.ldap.attributes.binary" 
value="objectSid"/>
         <!-- If we are following from the GC we need thus on -->
         <LDAPProperty name="java.naming.referral" value="follow"/>
     </resolver:DataConnector>


Could that /FilterTemplate/ section highlighted above be keeping other 
attributes from being pulled?

Thanks!


-- 

++++++++++++++++++++++++++++
Brian Gibson
Systems Administrator
Wheaton College

Are you a musician? If so visit my Arbans Online music site at
http://arbansonline.com and listen & contribute

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131008/ee644343/attachment-0001.html