Help with IdP attribute configuration

[Peter Schober]

* mariasol <sol.garcia at globant.com> [2014-07-18 18:41]:
> The issue I'm having is with the Attribute encoder, with this configuration
> looks like the attribute is been filtered:
> DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:263]
> - *Attribute ImmutableID was 
> not encoded (filtered by query, or no SAML2AttributeEncoder attached).*

That probably just means that it wasn't encoded as an attribute. The
latter ("no SAML2AttributeEncoder attached") is correct, of course.

Also note the comments on 'objectGUID' specifically:
https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues#LdapServerIssues-objectSidandobjectGUIDAttributes

> If I use other attribute  encoder it works and I see the attribute on the
> dummy SP I have locally. For example if I use the following attribute
> encoder:
> 		<resolver:AttributeEncoder xsi:type="SAML2String"
> 			xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
> 			name="ImmutableID" />

This is putting it into an attribute, not a NameID, hence no such
DEBUG message. The attribute (or nameFormat) is wrong, of course, as
"ImmutableID" clearly is not a URI, btw.

So we don't know yet whether your IDP is really sending the NameID or
not (which could have many reasons, to do with your
attribute-filter.xml and with the NameID selection process) and/or
whether your "dummy SP" is actually prepared to show NameID values in
the place where you're checking.
-peter