Not getting an attribute statement in IDP assertion

[Tom Zeller]

> On Oct 27, 2015, at 9:38 AM, Taylor Centers <taylor.centers at gmail.com> wrote:
> 
> I'm trying to get my ldap database associated with the users in the salesforce account, but no identifying information is being sent up with the assertion.  The Subject, NameID is a random transient value, and I couldn't figure out how to make it a persistent hash of user data. I tried changing saml-nameid.xml and saml-nameid.properties with no results, the entire NameID block would disappear from the assertion if I tried changing it.
> 
> Below is what I think the relevant files and fields for adding an attribute to the assertion, in my case the user's email.  But I am seeing no effect.  The logs look like it is getting the 'mail' attribute or at least parses the configuration properly, but I the array for included attributes is empty.
> 
> Does anyone notice something I'm doing wrong, or have an idea of how I can get this working?  Thanks for any input and advice.
> 
> 
> attribute-resolver.xml
>   
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail">  
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
>     </resolver:AttributeDefinition> 
>  
>         ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
>         baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
>         principal="%{idp.attribute.resolver.LDAP.bindDN}"
>         principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
>         useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
>         <dc:FilterTemplate>
>             <![CDATA[
>                 %{idp.attribute.resolver.LDAP.searchFilter}
>             ]]>
>         </dc:FilterTemplate>
>         <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
>             <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
>         </dc:StartTLSTrustCredential>
>     </resolver:DataConnector>
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail">
> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
> 
> attribute-filter.xml 
> 
> <afp:AttributeFilterPolicy id="example1">
>         <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://xxxxxxx.my.salesforce.com.org" />
>         <afp:AttributeRule attributeID="mail">
>             <afp:PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
> </afp:AttributeFilterPolicy>
> 
>  relying-party.xml
> 
> <util:list id="shibboleth.RelyingPartyOverrides">
>   <bean parent="RelyingPartyByName" c:relyingPartyIds="https://xxxxxxx.my.salesforce.com">
>      <property name="profileConfigurations">
>          <list>
>              <bean parent="SAML2.SSO" p:encryptAssertions="false" p:postAuthenticationFlows="attribute-release" p:includeAttributeStatement="true" />
>          </list>
>      </property>
> </bean>
> 
> idp-process.log
> 
> 2015-10-27 13:28:13,280 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:172] - Service 'shibboleth.AttributeResolverService': Performing initial load
> 2015-10-27 13:28:13,280 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:258] - Service 'shibboleth.AttributeResolverService': Reloading service configuration
> 2015-10-27 13:28:13,286 - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [~/shibboleth-idp/conf/attribute-resolver.xml]
> 2015-10-27 13:28:13,414 - INFO [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:58] - Parsing configuration for AttributeDefinition plugin with id : mail
> 2015-10-27 13:28:13,415 - INFO [net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:52] - Parsing configuration for Dependency with pluginId : myLDAP
> 2015-10-27 13:28:13,438 - INFO [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:58] - Parsing configuration for DataConnector plugin with id : myLDAP
> 2015-10-27 13:28:13,488 - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:510] - Refreshing ApplicationContext:shibboleth.AttributeResolverService: startup date [Tue Oct 27 13:28:13 UTC 2015]; parent: Root WebApplicationContext
> 2015-10-27 13:28:13,944 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:378] - Service 'shibboleth.AttributeResolverService': Completed reload and swapped in latest configuration for service 'shibboleth.AttributeResolverService' 
> .....
> 2015-10-27 13:28:16,661 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:135] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers [] 

The “attributes [] and headers []” logged above are the HTTP request attributes and headers from which the remote username will attempt to be determined, not the attributes resolved by the IdP via attribute-resolver.xml and attribute-filter.xml (which can be debugged/tested via bin/aacli.bin|sh). Not much help, but that’s a start.