Scoping an attribute

[Nate Klingenstein]

Dave,

You've got three options available to you: pass an attribute that doesn't have the scope, or strip the scope from the received data, or use the scoped usernames in Blackboard.  The "right" option will depend on your environment and which data you would like to use.  The scoped attribute decoder doesn't do any manipulation of the values AFAIK, though it may trigger checks if the filters are so configured.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeDecoder#NativeSPAttributeDecoder-ScopedAttributeDecoder

Take care,
Internet.

On Oct 6, 2014, at 12:20 PM, Dave Vernon <dvernon at loyalistcollege.com<mailto:dvernon at loyalistcollege.com>> wrote:

Hello again Internet,

Thanks largely to the help of this group, I now have my Shib SP talking to my Shib IdP, which I am using to protect my Blackboard learn server.

I’m down to one final issue that I’ve been working through.  My blackboard server has the users created with their username from Active Directory (i.e. the sam account name in windows), so, for example my logon is dvernon

I have the following setup in my attribute map on the SP


   <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
</Attribute>

I am able to login and authenticate to shibboleth, but the authentication fails at blackboard.  I’ve found that the username is arriving in the UPN format (i.e. dvernon at ads.loyalistcollege.ca<mailto:dvernon at ads.loyalistcollege.ca>).   (The good news is that everything works if I change the Blackboard userid field to match the upn_

I thought that the ScopedAttributeDecoder was supposed to drop the domain portion.. at least that was my understanding from the documentation.  I did double check the IdP to make sure that ‘ads.loyalistcollege.ca<http://ads.loyalistcollege.ca/>’ was in the md for the scope there.

The log on the SP seems to think it’s being scoped

2014-10-06 11:15:53 DEBUG Shibboleth.AttributeDecoder.Scoped [1]: decoding ScopedAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)

Any ideas what I’m missing to allow ONLY the username portion to be delivered?

Thanks!

Dave Vernon
Technology Infrastructure Specialist
dvernon at loyalistc.on.ca<mailto:dvernon at loyalistc.on.ca>
loyalistcollege.com<http://loyalistcollege.com/>

<image001.png><http://www.loyalistcollege.com/><image002.png><https://www.facebook.com/loyalistcollege><image003.png><https://twitter.com/loyalistcollege>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141006/2c84b363/attachment-0001.html