Filtering attributes problem

[Gene Matthews]

I seem to be having a problem getting the attributes I want released. I'm trying to use the aacli.sh script to verify what will be released. I'm definitely missing something as it is only releasing a few of the ones I want. 

I'm doing this: 

cd /opt/shibboleth-idp/conf 
../bin/aacli.sh --configDir=. --principal=gene.matthews at hitachi-cta.com 
<?xml version="1.0" encoding="UTF-8"?><saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"> 
<saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> 
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Gene</saml2:AttributeValue> 
</saml2:Attribute> 
<saml2:Attribute FriendlyName="postalCode" Name="urn:oid:2.5.4.17" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> 
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">30092</saml2:AttributeValue> 
</saml2:Attribute> 
<saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> 
<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Gene.Matthews at hitachi-cta.com</saml2:AttributeValue> 
</saml2:Attribute> 
</saml2:AttributeStatement> 

Seems I'm only passing the givenName, postalCode and email successfully.  I'm trying to pass these (from attribute-filter.xml):


<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
        <afp:PolicyRequirementRule xsi:type="basic:ANY"/>

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="email">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="postalCode">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="givenName">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="externalAcct">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="userType">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="userName">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="passwordChangeRequired">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>


>From attribute-resolver.xml, I have userName (for example) defined as follows:
    <!-- ========================================= -->
    <!--                                           -->
    <!--  Gene's entries                           -->
    <!--    Custom LDAP attributes                 -->
    <!-- ========================================= -->
    <!-- Schema: hctaSs0Person schema attributes-->

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="userName" sourceAttributeID="userName">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" name="userName" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="externalAcct" sourceAttributeID="externalAcct">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />
        <!--
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.4203.666.1.90" friendlyName="externalAcct" />
        -->
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" name="uid" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" name="uid" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="passwordChangeRequired" sourceAttributeID="passwordChangeRequired">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" name="passwordChangeRequired" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
    </resolver:AttributeDefinition>

In the idp-process.log, where I was trying this with an SP we are working with, I see the assertion (looks just like the output of the AACLI above) and then a log entry like this:


13:38:18.855 - INFO [Shibboleth-Audit:1028] - 20130911T133818Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_d83bd9126c6e0ed6dad05f846c049ce51102acd33e|mios|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://myIdP.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_ebc3261b49dda867ff0a7e958fdc5ed9|user@company.com|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|givenName,userType,externalAcct,email,|admin|_1c21491037210e2aaeb742126fcd86b4,|


further up in the logs I see where it is going through its paces on the attributes for externalAcct:

Attribute externalAcct has 1 values after post-processing
shibboleth.AttributeResolver resolved, for principal user at company.com, the attributes: [uid, surname, givenName, userType, externalAcct, organizationalUnit, commonName, email]
Processing permit value rule for attribute externalAcct for principal user at company.com
Attribute externalAcct has 1 values after filtering
Filtered attributes for principal user at company.com.  The following attributes remain: [givenName, userType, externalAcct, email]
Attribute externalAcct was not encoded (filtered by query, or no SAML2AttributeEncoder attached)   <-- assuming this is the start of my problems....gene
Retaining attribute externalAcct which may be encoded to via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
Retaining attribute externalAcct which may be encoded as a name identifier of format urn:oasis:names:tc:SAML:2.0:nameid-format:transient

I don't see any other references in idp-process.log referring to externalAcct until the assertion is shown and the INFO line above.  I am obvisously missing some understanding of the attribute resolution and filtering process.  If anyone can point me in the right direction, I would be grateful.

Thanks,

gene