Salesforce error when authing against Shibboleth

[Cantor, Scott]

On 8/8/14, 7:04 PM, "Ben Branch" <BBranch at uco.edu> wrote:

>attribute-resolver.xml:
>
><resolver:AttributeDefinition xsi:type="ad:Simple" id="email"
>sourceAttributeID="mail">
>        <resolver:Dependency ref="myLDAP" />
>        <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
>xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
>        <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
>xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>nameFormat="urn:oasis:tc:SAML:2.0:nameid-format:unspecified" />
>    </resolver:AttributeDefinition>

That is, appearances aside, not ending up as a SAML attribute. It's a
NameID/NameIdentifier, in the subject. That won't show up as an Attribute,
and it will be ignored by testshib, which is why it's sending a query
afterwards. There's nothing to be "fixed" in that sense, it just isn't how
we do things in the Shibboleth world, we use Attributes pretty much
exclusively.

Salesforce supports either approach, you can provide the data in the
NameID or in an Attribute. We would advise the latter.

However, if you had a release rule in place that was correct, your log
would still tell you that in the list of raw attributes it documents in
the audit log entry.

>    <afp:AttributeFilterPolicy>
>      <afp:PolicyRequirementRule
>xsi:type="basic:AttributeRequesterString" value="sp.testshib.org"/>
>      <afp:AttributeRule attributeID="mail">

That's simply wrong per the above definition. mail != email. You can't
release the raw data produced by a DataConnector, LDAP or otherwise. Rules
refer to the attribute definitions, which you have used above to turn
"mail" into "email".

-- Scott