Newbie question: Passing attributes from ADSF through Shibboleth

[Nate Klingenstein]

Griffin,

I'm not sure why you think something wrong is happening.  Everything that I see in your logs appears normal to me except that Microsoft's proprietary UPN is unmapped.

2013-10-30 17:29:23 INFO Shibboleth.AttributeExtractor.XML [5]: skipping unmapped SAML 2.0 Attribute with Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified

You will need to add a rule to attribute-map.xml that matches this name and  name format and assign it an environment variable.

Thanks,
Nate.

________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Griffin Cheng [CLIB] <cscheng at cpce-polyu.edu.hk>
Sent: Thursday, October 31, 2013 4:34
To: users at shibboleth.net
Subject: Re: Newbie question: Passing attributes from ADSF through Shibboleth

Hello all,

Further to my question below, I check the log and find the followings:

2013-10-30 17:29:23 DEBUG Shibboleth.SSO.SAML2 [5]: extracting pushed attributes...
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeExtractor.XML [5]: unable to extract attributes, unknown XML object type: samlp:Response
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeExtractor.XML [5]: unable to extract attributes, unknown XML object type: {urn:oasis:names:tc:SAML:2.0:assertion}AuthnStatement
2013-10-30 17:29:23 INFO Shibboleth.AttributeExtractor.XML [5]: skipping unmapped SAML 2.0 Attribute with Name: http://schemas.xmlsoap.org/claims/Group, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
2013-10-30 17:29:23 INFO Shibboleth.AttributeExtractor.XML [5]: skipping unmapped SAML 2.0 Attribute with Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeDecoder.String [5]: decoding SimpleAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeDecoder.Scoped [5]: decoding ScopedAttribute (ePSA) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.9) with 1 value(s)
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeFilter [5]: filtering 2 attribute(s) from (http://adfs.cpce-polyu.edu.hk/adfs/services/trust)
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeFilter [5]: applying filtering rule(s) for attribute (ePSA) from (http://adfs.cpce-polyu.edu.hk/adfs/services/trust)
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeFilter [5]: applying filtering rule(s) for attribute (eppn) from (http://adfs.cpce-polyu.edu.hk/adfs/services/trust)
2013-10-30 17:29:23 DEBUG Shibboleth.SSO.SAML2 [5]: resolving attributes...
2013-10-30 17:29:23 DEBUG Shibboleth.AttributeResolver.Query [5]: found AttributeStatement in input to new session, skipping query

Whas has gone wrong?


Regards,


Griffin CHENG.
Telephone: 3746 0853

* Griffin Cheng [CLIB] <cscheng at cpce-polyu.edu.hk<mailto:cscheng at cpce-polyu.edu.hk>> [2013-10-30 10:59]:

> Hello,

>

> I construct a small "attribute-map.xml" file to extract attributes from the institution's ADSF as follows:

>

> <Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map"

> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

>

>     <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">

>         <AttributeDecoder xsi:type="StringAttributeDecoder"/>

>     </Attribute>

>

>     <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" id="ePSA">

>         <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>

>     </Attribute>

>

>     <Attribute nameFormat="http://schemas.xmlsoap.org/claims"

> name="urn:oid:2.5.4.9" id="street"/>

>

> </Attributes>



> I can see the values [eppn] and [ePSA] fine.  However, the value of

> the "street" attribute is missing.  The ADSF admin claims that the

> test account should have the "street" value added.



Look at your shibd.log, possibly on DEBUG, it will tell you exactly what it did what all attributes, and why.



If I had to guess I would say that the attribute name is wrong, it will likely not be called "urn:oid:2.5.4.9" on the wire if you had to adjust the nameFormat to be something else than URI.



> Do I have to add the "street" attribute also to the metadata provider?

> If so, what should it look like?



"Also"? You don't configure attributes in a MetadataProvider at all.

-peter

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131031/bff26f7f/attachment-0001.html