SP 2.5 + Windows Apache 2.2 not populating environment vars

[Jerry B. Altzman]

Hi, and thanks again!

On Wed Dec 03 2014 at 2:49:32 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> You didn't say what was in the log, so I don't know.
>

Of course you couldn't -- my bad for not providing sufficient detail.


> No, that's in the XML. I'm talking about what the SP is doing with it. If
> you don't have a mapping rule for something it sees, it will log that it's
> been skipped. And the tran log shows exactly what it did extract and
> cache, and the Session dumping handler shows roughly the same thing.
>

So all this means...that shibd is getting the XML, and unpacking it, and
then not knowing what to do with the mapping?

>And in my attribute-map.xml, I have (not commented out)
> >     <Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"
> >NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" />
> >and
> >    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>
> Then you should have clear log evidence and session dump evidence that
> they're there.
>

In which log might I find these? What other knobs can I twiddle to find
these?

In shibd.logger, I have pretty much everything set to DEBUG

The transaction log has many lines like
2014-12-03 14:46:48 INFO Shibboleth-TRANSACTION [5]: New session (ID:
_13032dbfdee80993f655dfc5597c686c) with (applicationId: default) for
principal from (IdP: https://idp.testshib.org/idp/shibboleth) at
(ClientAddress: a.b.c.d) with (NameIdentifier:
_55ca2e3ca8fc071da6bf1ecb76d36e8e) using (Protocol:
urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID:
_b7d624b7035aecf9caabcf4f36344e57)
2014-12-03 14:46:48 INFO Shibboleth-TRANSACTION [5]: Cached the following
attributes with session (ID: _13032dbfdee80993f655dfc5597c686c) for
(applicationId: default) {
2014-12-03 14:46:48 INFO Shibboleth-TRANSACTION [5]: }

>But there are no variables at all...thus my confusion.
> You can't get the other variables and not get the attributes, so that
> suggests to me you're not actually mapping the attributes that you think
> you are, but there are ways to tell.
>

How can I tell? I'm breathless with debugging-anticipation! :-)


> One possibility is you changed the attribute map and didn't restart
> things. The map does not reload by default, unlike most of the
> configuration.
>

I have bounced shibd many times, but I can bounce it one more.

Once again, thanks for your patience and help with a shibbo-noob.

-- Scott


//jbaltz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141203/fdcdb062/attachment.html