SAML Salesforce Reponse coming in Transient Format
Cahill, Charles (GE Appliances)
Charles.Cahill at ge.com
Mon Nov 23 21:25:18 EST 2015
Can anyone give me an idea why headers are coming back to my 3rd party SAML 2.0 clients but dont seem to be coming back to my Apache Service Provider configurations.
Here are my Apache configurations to look at:
AttributeMap
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" id="transient-id"/>
<Attribute name="cn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="cn"/>
<Attribute name="firstname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="firstname"/>
<Attribute name="lastname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="lastname"/>
<Attribute name="email" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="email"/>
<Attribute name="uid" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="uid"/>
</Attributes>
Attributepolicy
<afp:AttributeFilterPolicyGroup
xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"
xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"
xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
xmlns:afp="urn:mace:shibboleth:2.0:afp"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
<!--
<afp:PolicyRequirementRule xsi:type="basic:ANY"/>
<afp:AttributeRule attributeID="*"> <afp:PermitValueRule xsi:type="ANY"/> </afp:AttributeRule>
<afp:AttributeRule attributeID="transient-id"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
-->
<afp:AttributeRule attributeID="uid"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
<afp:AttributeRule attributeID="email"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
<afp:AttributeRule attributeID="cn"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
<afp:AttributeRule attributeID="firstname"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
<afp:AttributeRule attributeID="lastname"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
</afp:AttributeFilterPolicy>
</afp:AttributeFilterPolicyGroup>
httpd.conf
<VirtualHost *:80>
ProxyPass /Shibboleth.sso !
ProxyPass / ${APPLICATION_ENDPOINT}
ProxyPassReverse /Shibboleth.sso !
ProxyPassReverse / ${APPLICATION_ENDPOINT}
RequestHeader set cn "%{cn}e"
RequestHeader set firstname "%{firstname}e"
RequestHeader set lastname "%{lastname}e"
RequestHeader set email "%{email}e"
RequestHeader set uid "%{uid}e"
<Location /Shibboleth.sso>
Satisfy Any
Allow from all
</Location>
<Location /NPI/>
AuthType shibboleth
ShibRequestSetting requireSession 1
require valid-user
ShibUseHeaders On
</Location>
</VirtualHost>
More information about the users
mailing list