Recreating IdP metadata after regenerating certificates?

David Gersic dgersic at niu.edu
Fri Apr 24 11:24:19 EDT 2015 

I'm not seeing attributes in shibd.log, but I'm not entirely sure what I'm looking for in shibd.log, so it's possible that I'm missing something there.

I'm attempting to release some attributes to testshib, and I think I've got the filter policy set up correctly.

    <!--  Release attributes to TestShib.Org  -->
    <afp:AttributeFilterPolicy id="releaseToTestshibDotOrg">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://sp.testshib.org/shibboleth-sp" />

        <afp:AttributeRule attributeID="eduPersonAffiliation">
            <afp:PermitValueRule xsi:type="basic:OR">
                <basic:Rule xsi:type="basic:AttributeValueString" value="faculty" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="student" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="staff" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="alum" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="member" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="affiliate" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="employee" ignoreCase="true" />
                <basic:Rule xsi:type="basic:AttributeValueString" value="library-walk-in" ignoreCase="true" />
            </afp:PermitValueRule>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonPrimaryAffiliation">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonEntitlement">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonTargetedID">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="displayName">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="sn">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="givenName">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

I don't see anything in the idp-process.log to indicate that testshib.org requested any of these, just transientID and eduPersonTargetedID:

09:45:11.080 - INFO [Shibboleth-Audit:970] - 20150424T144511Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_fe9d487fe8d2d3b56e3be374bb0a63dd|https://sp.testshib.org/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp-dev.niu.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_694f63275e659ec400690f7b5a842035|a02dag1|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|transientId,eduPersonTargetedID,|_4019cdb926244658569ed41b61e2ee48||

That seems to match what I'm seeing in shibd.log:

2015-04-24 11:13:30 DEBUG Shibboleth.SSO.SAML2 [25]: SSO profile processing completed successfully
2015-04-24 11:13:30 WARN Shibboleth.SSO.SAML2 [25]: no AttributeExtractor plugin installed, check log during startup
2015-04-24 11:13:30 DEBUG Shibboleth.SSO.SAML2 [25]: resolving attributes...
2015-04-24 11:13:30 DEBUG Shibboleth.AttributeResolver.Query [25]: found AttributeStatement in input to new session, skipping query
2015-04-24 11:13:30 DEBUG Shibboleth.SessionCache [25]: creating new session
2015-04-24 11:13:30 DEBUG Shibboleth.SessionCache [25]: storing new session...
2015-04-24 11:13:30 DEBUG XMLTooling.StorageService [25]: inserted record (session) in context (_6a0fe098bc505e6640e1e0800357b655) with expiration (1429892010)
2015-04-24 11:13:30 DEBUG XMLTooling.StorageService [25]: updated record (_4019cdb926244658569ed41b61e2ee48) in context (NameID) with expiration (1429917210)
2015-04-24 11:13:30 DEBUG XMLTooling.StorageService [25]: inserted record (_16242fc351344e9628cd0c595b31178d) in context (_6a0fe098bc505e6640e1e0800357b655) with expiration (1429892010)
2015-04-24 11:13:30 INFO Shibboleth.SessionCache [25]: new session created: ID (_6a0fe098bc505e6640e1e0800357b655) IdP (https://idp-dev.niu.edu/idp/shibboleth) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (131.156.157.224)
2015-04-24 11:13:30 DEBUG Shibboleth.SSO.SAML2 [25]: ACS returning via redirect to: https://sp.testshib.org/testing/sample.jsp
2015-04-24 11:13:31 DEBUG Shibboleth.Listener [31]: dispatching message (default::getHeaders::Application)
2015-04-24 11:13:31 DEBUG Shibboleth.Listener [31]: dispatching message (find::StorageService::SessionCache)


sample.jsp is displaying only some session info:

    referer is: https://idp-dev.niu.edu/idp/profile/SAML2/Redirect/SSO
    Shib-Session-ID is: _06210a9890174cf3cd16ce31ebadea62
    Shib-Session-Index is: 45686bed29f864bc1eb582f719e94026085223fc2179d281c2312d52e7aabee7
    Shib-Identity-Provider is: https://idp-dev.niu.edu/idp/shibboleth
    Shib-Authentication-Method is: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    Shib-Authentication-Instant is: 2015-04-24T14:45:10.624Z
    Shib-AuthnContext-Class is: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    Shib-Application-ID is: default

It's been a while since I used testshib.org, but from what I recall of it, sample.jsp used to show whichever attributes I released to it. If sample.jsp depends on AttributeExtractor, which isn't working, that would explain why sample.jsp isn't displaying anything, but should I see more in the shibd.log and idp-process.log to indicate that testshib.org requested attributes mail / eduPersonAffiliation / etc. from me? Or doesn't testshib.org request anything but transientId and eduPersonTargetedID now?



________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Kevin Foote <kpfoote at uoregon.edu>
Sent: Thursday, April 23, 2015 4:34 PM
To: Shib Users
Subject: Re: Recreating IdP metadata after regenerating certificates?

> On Apr 23, 2015, at 1:57 PM, David Gersic <dgersic at niu.edu> wrote:
>
> That's about what it does. There is some session info shown, but none of the released attributes.

Attributes are in the logs if you can’t see them on the post login sp page.
If you see no attributes there (the fail safe spot - for testshib) then your IdP did not release them.

________________________________________
> From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
>
> There's no sign I can see that it's not accepting the signature, the log
> clearly shows that working. The line about there being no
> AttributeExtractor plugin installed means something broke. It will just
> accept the login and show no data, I'd imagine.

To Scotts point the AttributeExtractor borks due to resource contention on the host (as mentioned before, multitasked
minimal resource footprint. :-)

--------
thanks
 kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

More information about the users mailing list