Problem passing attribute once upgrading to version 3
Todd Vernick
tvernick at squarespace.com
Wed Jul 15 15:54:27 EDT 2015
My SP requires the assertion:
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
or
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
I used the following config to pass uid to pass this in shibboleth version 2
attribute_resolver.xml
<resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
sourceAttributeID="uid">
<resolver:Dependency ref="myLDAP" />
<resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:uid" />
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
</resolver:AttributeDefinition>
relying_party.xml
<rp:RelyingParty
id="http://fs.ultiproworkplace.com/adfs/services/trust"
provider="https://idp.squarespace.net/idp/shibboleth"
defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
defaultSigningCredentialRef="IdPCredential">
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
includeAttributeStatement="true"
assertionLifetime="300000"
assertionProxyCount="0"
signResponses="conditional"
signAssertions="never"
signRequests="conditional"
encryptAssertions="never"
encryptNameIds="never"
/>
</rp:RelyingParty>
Version 3 carried over a different relying_party config
<bean parent="RelyingPartyByName" c:relyingPartyIds="
http://fs.ultiproworkplace.com/adfs/services/trust">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:encryptAssertions="false" />
</list>
</property>
</bean>
And I used the same attribute_resolver config for version 3.
When decoding the saml response, it's not showing a 1.1:nameid-format
anymore, only 2.0 formats.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/361add7e/attachment.html>
More information about the users
mailing list