Salesforce error when authing against Shibboleth

[Ben Branch]

Okay,  just to be sure I understand this correctly.  The attributeID that is used in the attribute-filter needs to match the id that is used in the attribute resolver?  eg.  <resolver:AttributeDefinition xsi:type="ad:Simple" id="email"> needs to be <afp:AttributeRule attributeID="email">?


Ben Branch
Sun Administrator
University of Central Oklahoma
ITIL Foundation v3, Network+, RHCSA

100 N. University Drive, Box 122
Edmond, OK 73034
D: 405.974.2649 | M: 405.550.6804 | bbranch at uco.edu | www.uco.edu
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] On Behalf Of Cantor, Scott [cantor.2 at osu.edu]
Sent: Friday, August 08, 2014 6:15 PM
To: Shib Users
Subject: Re: Salesforce error when authing against Shibboleth

On 8/8/14, 7:04 PM, "Ben Branch" <BBranch at uco.edu> wrote:

>attribute-resolver.xml:
>
><resolver:AttributeDefinition xsi:type="ad:Simple" id="email"
>sourceAttributeID="mail">
>        <resolver:Dependency ref="myLDAP" />
>        <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
>xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
>        <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
>xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>nameFormat="urn:oasis:tc:SAML:2.0:nameid-format:unspecified" />
>    </resolver:AttributeDefinition>

That is, appearances aside, not ending up as a SAML attribute. It's a
NameID/NameIdentifier, in the subject. That won't show up as an Attribute,
and it will be ignored by testshib, which is why it's sending a query
afterwards. There's nothing to be "fixed" in that sense, it just isn't how
we do things in the Shibboleth world, we use Attributes pretty much
exclusively.

Salesforce supports either approach, you can provide the data in the
NameID or in an Attribute. We would advise the latter.

However, if you had a release rule in place that was correct, your log
would still tell you that in the list of raw attributes it documents in
the audit log entry.

>    <afp:AttributeFilterPolicy>
>      <afp:PolicyRequirementRule
>xsi:type="basic:AttributeRequesterString" value="sp.testshib.org"/>
>      <afp:AttributeRule attributeID="mail">

That's simply wrong per the above definition. mail != email. You can't
release the raw data produced by a DataConnector, LDAP or otherwise. Rules
refer to the attribute definitions, which you have used above to turn
"mail" into "email".

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
**Bronze+Blue=Green** The University of Central Oklahoma is Bronze, Blue, and Green! Please print this e-mail only if absolutely necessary!

**CONFIDENTIALITY** -This e-mail (including any attachments) may contain confidential, proprietary and privileged information. Any unauthorized disclosure or use of this information is prohibited.