Problem passing attribute once upgrading to version 3

Todd Vernick tvernick at squarespace.com
Wed Jul 15 15:54:27 EDT 2015


My SP requires the assertion:
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
or
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

I used the following config to pass uid to pass this in shibboleth version 2

attribute_resolver.xml
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:uid" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
    <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
    </resolver:AttributeDefinition>

relying_party.xml
        <rp:RelyingParty
                id="http://fs.ultiproworkplace.com/adfs/services/trust"
                provider="https://idp.squarespace.net/idp/shibboleth"

defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
        defaultSigningCredentialRef="IdPCredential">
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
        includeAttributeStatement="true"
        assertionLifetime="300000"
        assertionProxyCount="0"
        signResponses="conditional"
        signAssertions="never"
        signRequests="conditional"
        encryptAssertions="never"
        encryptNameIds="never"
/>
        </rp:RelyingParty>


Version 3 carried over a different relying_party config
        <bean parent="RelyingPartyByName" c:relyingPartyIds="
http://fs.ultiproworkplace.com/adfs/services/trust">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

And I used the same attribute_resolver config for version 3.
When decoding the saml response, it's not showing a 1.1:nameid-format
anymore, only 2.0 formats.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/361add7e/attachment.html>


More information about the users mailing list