Attribute not sending to new SP

David Perry DPerry at hull-college.ac.uk
Mon Sep 30 10:49:12 EDT 2013 

Hi there

I've setup a new (2.5.2) Service Provider under Server 2008 / IIS 7.5. The basics are tested, and I've setup the following attribute-filter definition (the same as it was for our old 2.4.2 SP, but with the requesterString updated):

            <AttributeFilterPolicy>
            <!-- Login folder for Heritage sites-->
                        <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://heritage.hull-college.ac.uk/shibboleth" />

                        <AttributeRule attributeID="eduPersonPrincipalName">
                                    <PermitValueRule xsi:type="basic:ANY" />
                        </AttributeRule>
                        <!--location information in this one: -->
                        <AttributeRule attributeID="eduPersonOrgDN">
                                    <PermitValueRule xsi:type="basic:ANY" />
                        </AttributeRule>
            </AttributeFilterPolicy>

This published them as HTTP_EPPN and HTTP_ORGDN.

However, 2.5.2 doesn't want to interpret the ORGDN bit (EPPN is coming through fine, to HTTP_EPPN if I run a PHP script to spit out all the $_SERVER headers) even though it acknowledges there is an attribute - but it doesn't like that attribute, so here's a cranked up DEBUG including the (decoded) assertion:

2013-09-30 15:32:25 DEBUG XMLTooling.TrustEngine.ExplicitKey [2]: attempting to validate signature with the peer's credentials
2013-09-30 15:32:25 DEBUG XMLTooling.TrustEngine.ExplicitKey [2]: signature validated with credential
2013-09-30 15:32:25 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [2]: signature verified against message issuer
2013-09-30 15:32:25 DEBUG Shibboleth.SSO.SAML2 [2]: processing message against SAML 2.0 SSO profile
2013-09-30 15:32:25 DEBUG XMLTooling.CredentialCriteria [2]: key algorithm didn't match ('AES' != 'RSA')
2013-09-30 15:32:25 DEBUG Shibboleth.SSO.SAML2 [2]: decrypted Assertion: <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_d22b0fc787915f870a56a0a366727fc7" IssueInstant="2013-09-30T14:32:46.298Z" Version="2.0"><saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://shibb.hull-college.ac.uk/idp/shibboleth</saml2:Issuer><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://shibb.hull-college.ac.uk/idp/shibboleth" SPNameQualifier="https://heritage.hull-college.ac.uk/shibboleth">_116b36fb647ed7e4ae193cd685ad2b5f</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="192.168.180.200" InResponseTo="_71c182c565c70256b0ae8d775828ec6c" NotOnOrAfter="2013-09-30T14:37:46.298Z" Recipient="http://heritage.hull-college.ac.uk/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2013-09-30T14:32:46.298Z" NotOnOrAfter="2013-09-30T14:37:46.298Z"><saml2:AudienceRestriction><saml2:Audience>https://heritage.hull-college.ac.uk/shibboleth</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2013-09-30T14:32:45.219Z" SessionIndex="de97341b53b66b7a9727ef430c2c9d31f67cbcd9a980b4a3963a214d69fdaadf"><saml2:SubjectLocality Address="192.168.180.200"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">70012521 at hull-college.ac.uk</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="eduPersonOrgDN" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">cn=70012521,ou=Admin,ou=Qngn,o=hull_coll</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion>
2013-09-30 15:32:25 DEBUG Shibboleth.SSO.SAML2 [2]: extracting issuer from SAML 2.0 assertion
2013-09-30 15:32:25 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [2]: evaluating message flow policy (replay checking on, expiration 60)
2013-09-30 15:32:25 DEBUG XMLTooling.StorageService [2]: inserted record (_d22b0fc787915f870a56a0a366727fc7) in context (MessageFlow) with expiration (1380551806)
2013-09-30 15:32:25 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [2]: assertion satisfied bearer confirmation requirements
2013-09-30 15:32:25 DEBUG Shibboleth.SSO.SAML2 [2]: SSO profile processing completed successfully
2013-09-30 15:32:25 DEBUG Shibboleth.SSO.SAML2 [2]: extracting pushed attributes...
2013-09-30 15:32:25 DEBUG Shibboleth.AttributeExtractor.XML [2]: unable to extract attributes, unknown XML object type: saml2p:Response
2013-09-30 15:32:25 DEBUG Shibboleth.AttributeExtractor.XML [2]: skipping unmapped NameID with format (urn:oasis:names:tc:SAML:2.0:nameid-format:transient)
2013-09-30 15:32:25 DEBUG Shibboleth.AttributeExtractor.XML [2]: unable to extract attributes, unknown XML object type: saml2:AuthnStatement
2013-09-30 15:32:25 DEBUG Shibboleth.AttributeDecoder.Scoped [2]: decoding ScopedAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)
2013-09-30 15:32:25 INFO Shibboleth.AttributeExtractor.XML [2]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:1.3.6.1.4.1.5923.1.1.1.3
2013-09-30 15:32:25 DEBUG Shibboleth.AttributeFilter [2]: filtering 1 attribute(s) from (https://shibb.hull-college.ac.uk/idp/shibboleth)
2013-09-30 15:32:25 DEBUG Shibboleth.AttributeFilter [2]: applying filtering rule(s) for attribute (eppn) from (https://shibb.hull-college.ac.uk/idp/shibboleth)
2013-09-30 15:32:25 DEBUG Shibboleth.SSO.SAML2 [2]: resolving attributes...
2013-09-30 15:32:25 DEBUG Shibboleth.AttributeResolver.Query [2]: found AttributeStatement in input to new session, skipping query
2013-09-30 15:32:25 DEBUG Shibboleth.SessionCache [2]: creating new session
2013-09-30 15:32:25 DEBUG Shibboleth.SessionCache [2]: storing new session...
2013-09-30 15:32:25 DEBUG XMLTooling.StorageService [2]: inserted record (session) in context (_7b29d82fbc7a62bca914fbe184701f98) with expiration (1380555145)
2013-09-30 15:32:25 DEBUG XMLTooling.StorageService [2]: inserted record (_116b36fb647ed7e4ae193cd685ad2b5f) in context (NameID) with expiration (1380580345)
2013-09-30 15:32:25 DEBUG XMLTooling.StorageService [2]: inserted record (_d22b0fc787915f870a56a0a366727fc7) in context (_7b29d82fbc7a62bca914fbe184701f98) with expiration (1380555145)
2013-09-30 15:32:25 INFO Shibboleth.SessionCache [2]: new session created: ID (_7b29d82fbc7a62bca914fbe184701f98) IdP (https://shibb.hull-college.ac.uk/idp/shibboleth) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (127.0.0.1)
2013-09-30 15:32:25 DEBUG XMLTooling.StorageService [2]: deleted record (f854f2c721754b77fb619fd6440945e529ba0ff09c79ad5a6ab2051b0eeab422) in context (RelayState)
2013-09-30 15:32:25 DEBUG Shibboleth.SSO.SAML2 [2]: ACS returning via redirect to: http://heritage.hull-college.ac.uk/secure/hello.php

Any ideas appreciated.


Thanks,
Dave


David Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

Message scanned

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130930/0a0c1f78/attachment-0001.html

More information about the users mailing list