Newbie question: Passing attributes from ADSF through Shibboleth

[Peter Schober]

* Griffin Cheng [CLIB] <cscheng at cpce-polyu.edu.hk> [2013-10-31 05:36]:
> 2013-10-30 17:29:23 INFO Shibboleth.AttributeExtractor.XML [5]:
> skipping unmapped SAML 2.0 Attribute with Name:
> http://schemas.xmlsoap.org/claims/Group,
> Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified

> 2013-10-30 17:29:23 INFO Shibboleth.AttributeExtractor.XML [5]:
> skipping unmapped SAML 2.0 Attribute with Name:
> http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn,
> Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified

> Whas has gone wrong?

The default attribute-map.xml has no entries for such attributes.
So you'll need to add them.

Here's how to find the documentation, from
https://wiki.shibboleth.net/confluence/display/SHIB2/

-> Configuration
https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration

-> Use a new attribute
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute

-> To find out about nameFormat: XML Attribute Extractor, Child elements
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor

Granted that last step is well hidden and you're only likely to find
it if you already know what you're searching for.

Anyway: From the log entry you posted above I would assume it would
need to look something like this:

<Attribute name="http://schemas.xmlsoap.org/claims/Group" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" id="group" />

<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" id="upn" />

Then restart shibd (unless you have it auto-reload the attribute map,
which defaults to false in current releases) and check your shibd.log
again.
-peter