Problem passing attribute once upgrading to version 3

[Todd Vernick]

Yes, that does not work with the changed values.

On Wed, Jul 15, 2015 at 4:35 PM, McKean, Brandon Scott - mckeanbs <
mckeanbs at jmu.edu> wrote:

> Hi Todd,
>
> Sorry it's giving you trouble. :(
>
> For clarity you wouldn't be able to straight copy what I gave. In your
> case saml-nameid.xml would probably need to be more like:
>
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>             p:attributeSourceIds="uid" />
>
> Then in relying-party.xml right next to "p:encryptAssertions="false" in
> that section:
>
>
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>
> Hope that makes sense, but let me know if that's how you did it already.
>
> Thanks,
>
>
> -- Brandon McKean IT / Systems Linux Administrator
> (540)568-4235
>
> On Wed, 2015-07-15 at 16:17 -0400, Todd Vernick wrote:
>
> Hi Brandon,
> I just added what you specified but still don't see the 1.1 values :(
>
> On Wed, Jul 15, 2015 at 4:06 PM, McKean, Brandon Scott - mckeanbs <
> mckeanbs at jmu.edu> wrote:
>
> Hi Todd,
>
> I had to mess with something very similar for configuring ArcGIS. Here's
> what I had to do for this:
>
> Here's what I did in saml-nameid.xml:
>
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>             p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"
>             p:attributeSourceIds="cn" />
>
> The eid part is arbitrary, you just need to keep it consistent across the
> config You can have it be emailaddress too.
>
> Then, in relying-party.xml:
>
> <bean parent="RelyingPartyByName" c:relyingPartyIds="JMU.maps.arcgis.com
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__JMU.maps.arcgis.com&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=uRQHxT7ztgm1zlQXb6QFDU_ZN9XDwURHDdKvUzKIS6Y&s=jCvnxi7VbGBYa7ymhnfLjq0zP9svWze4LTDiT_RRSQQ&e=>
> ">
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO" p:encryptAssertions="false"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"/>
>  </list>
>             </property>
>         </bean>
>
>
>
> Hope this snippet helps.
>
>
>
> -- Brandon McKean IT / Systems Linux Administrator
> (540)568-4235
>
> On Wed, 2015-07-15 at 15:54 -0400, Todd Vernick wrote:
>
> My SP requires the assertion:
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
> or
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
>
> I used the following config to pass uid to pass this in shibboleth version
> 2
>
> attribute_resolver.xml
>     <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
> sourceAttributeID="uid">
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder
> xsi:type="enc:SAML1StringNameIdentifier"
> nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:uid" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
>     <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
> nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
>     </resolver:AttributeDefinition>
>
> relying_party.xml
>         <rp:RelyingParty
>                 id="http://fs.ultiproworkplace.com/adfs/services/trust
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__fs.ultiproworkplace.com_adfs_services_trust&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=Rp3z1M6pizj0BQjbrGP8-lWNTD3ZOEVN6Yu1IlzVr2M&e=>
> "
>                 provider="https://idp.squarespace.net/idp/shibboleth
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__idp.squarespace.net_idp_shibboleth&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=dprgEtghorgyPqpdnAUkp5NDCYNM_jn2o9hUNVWtDMw&e=>
> "
>
> defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
>         defaultSigningCredentialRef="IdPCredential">
> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
>         includeAttributeStatement="true"
>         assertionLifetime="300000"
>         assertionProxyCount="0"
>         signResponses="conditional"
>         signAssertions="never"
>         signRequests="conditional"
>         encryptAssertions="never"
>         encryptNameIds="never"
> />
>         </rp:RelyingParty>
>
>
> Version 3 carried over a different relying_party config
>         <bean parent="RelyingPartyByName" c:relyingPartyIds="
> http://fs.ultiproworkplace.com/adfs/services/trust
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__fs.ultiproworkplace.com_adfs_services_trust&d=BQMFaQ&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=52DshjGrtC1hnIIGi38fNHxQ1h-kWSJZLSJRdUYBQao&s=Rp3z1M6pizj0BQjbrGP8-lWNTD3ZOEVN6Yu1IlzVr2M&e=>
> ">
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO" p:encryptAssertions="false" />
>                 </list>
>             </property>
>         </bean>
>
> And I used the same attribute_resolver config for version 3.
> When decoding the saml response, it's not showing a 1.1:nameid-format
> anymore, only 2.0 formats.
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150715/93c826b4/attachment-0001.html>