Why is filter policy not active?

[Michael A Grady]

The AttributeRequesterString needs to match the EntityID of the requestor, which is in the Issuer element of that Authn Request. It's just "https://demo.origamirisk.com", without the rest of the URL you have in your current AttributeRequesterString values.

On Feb 11, 2014, at 2:40 PM, David Bantz wrote:

> 
> Here’s the filter policy
> 
> <AttributeFilterPolicy id="releaseToOrigami">
>    <PolicyRequirementRule xsi:type="basic:OR">
>                 <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK" />
>                 <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://live.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK" />
>         </PolicyRequirementRule>
>     <AttributeRule attributeID="bannerID">
>         <PermitValueRule xsi:type="basic:ANY" />
>     </AttributeRule>
>     <AttributeRule attributeID="displayname">
>          <PermitValueRule xsi:type="basic:ANY" />
>     </AttributeRule>
>     <AttributeRule attributeID="email">
>         <PermitValueRule xsi:type="basic:ANY" />
>     </AttributeRule>
> </AttributeFilterPolicy>
> 
> the incoming authN request
> 
> 11:19:32.828 - DEBUG [PROTOCOL_MESSAGE:113] - 
> <?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK" Destination="https://idp.alaska.edu/idp/profile/SAML2/POST/SSO" ForceAuthn="false" ID="_4C0655ABBA69A0F151CBA60B2BF32CF4" IsPassive="false" IssueInstant="2014-02-11T20:19:38Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
>    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://demo.origamirisk.com</saml:Issuer>
>    <samlp:NameIDPolicy AllowCreate="true"/>
> </samlp:AuthnRequest>
> 
> …
> 
> but IdP reports it is not active for this request
> 
> 11:19:46.595 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy releaseToOrigami is active for principal dabantz
> 11:19:46.596 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:134] - Filter policy releaseToOrigami is not active for principal dabantz
> …
> 11:19:46.607 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:128] - No attributes remained after encoding and filtering by value, no attribute statement built
> ...
> 11:19:46.627 - DEBUG [PROTOCOL_MESSAGE:74] - 
> <?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK”…
> 
> David Bantz
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140211/8bd6da20/attachment-0001.html