SAML Salesforce Reponse coming in Transient Format

Cahill, Charles (GE Appliances) Charles.Cahill at ge.com
Mon Nov 23 21:25:18 EST 2015


Can anyone give me an idea why headers are coming back to my 3rd party SAML 2.0 clients but dont seem to be coming back to my Apache Service Provider configurations.

Here are my Apache configurations to look at:

AttributeMap
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" id="transient-id"/>
        <Attribute name="cn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="cn"/>
        <Attribute name="firstname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="firstname"/>
        <Attribute name="lastname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="lastname"/>
        <Attribute name="email" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="email"/>
        <Attribute name="uid" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="uid"/>
</Attributes>

Attributepolicy
<afp:AttributeFilterPolicyGroup
  xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"
  xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"
  xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
  xmlns:afp="urn:mace:shibboleth:2.0:afp"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
  <!--              
                <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
    <afp:AttributeRule attributeID="*"> <afp:PermitValueRule xsi:type="ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="transient-id"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
  -->              
                <afp:AttributeRule attributeID="uid"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="email"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="cn"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="firstname"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>

                <afp:AttributeRule attributeID="lastname"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
        </afp:AttributeFilterPolicy>
</afp:AttributeFilterPolicyGroup>

httpd.conf 
<VirtualHost *:80>
  
        ProxyPass /Shibboleth.sso !      
	ProxyPass / ${APPLICATION_ENDPOINT}
        ProxyPassReverse /Shibboleth.sso !
	ProxyPassReverse / ${APPLICATION_ENDPOINT}
	RequestHeader set cn "%{cn}e"

	RequestHeader set firstname "%{firstname}e"
	RequestHeader set lastname "%{lastname}e"
	RequestHeader set email "%{email}e"
	RequestHeader set uid "%{uid}e"

	<Location /Shibboleth.sso>
	  Satisfy Any
	  Allow from all
	</Location>

	<Location /NPI/>
		AuthType shibboleth
		ShibRequestSetting requireSession 1
		require valid-user
		ShibUseHeaders On
	</Location>
</VirtualHost>


More information about the users mailing list