Not getting an attribute statement in IDP assertion

[Taylor Centers]

Scott -- NameID and Attributes are different, but I can use either to
associate a user from the ldap database with the user in salesforce.  I can
set a Federation ID for a salesforce user and make that the persistent
NameID that Shibboleth is sending up.

in saml-nameid.xml I comment out the bean for TransientGenerator and
uncomment the one for persistent generator:

<util:list id="shibboleth.SAML2NameIDGenerators">

    <ref bean="shibboleth.SAML2PersistentGenerator" />

In saml-nameid.properties I uncomment the lines for:

idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator

idp.persistentId.sourceAttribute = "%{idp.authn.LDAP.baseDN}"

idp.persistentId.salt = "randomstring123"


but the NameID Field no longer exists when I do that.


After I log in I only get one more line of the log

2015-10-27 17:26:46,336 - INFO
[net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:135] -
RemoteUserAuthServlet will process REMOTE_USER, along with attributes []
and headers []

2015-10-27 17:27:13,984 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] -
Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'user1'
succeeded


I'm looking at the assertion in the SAML tracer plugin on Firefox and see
there is no Attribute Block so I guess it is the attribute-resolver.xml
file that I'm doing something incorrectly in?

Is there any other info that I can get you where we might see the problem?


Tom -- ok, thanks I didn't really know what I was looking at, just saw the
empty array for attributes and made the assumption.

I see

{

"requester": "https://sp.testshib.org",

"principal": "user1",

"attributes": [



]

}

when I run aacli.sh.  Does this give us any insight into my problem?  Are
there any other tests I can run or info I can get to help us find the
problem?


Thanks everyone!

On Tue, Oct 27, 2015 at 12:33 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 10/27/15, 10:38 AM, "users on behalf of Taylor Centers" <
> users-bounces at shibboleth.net on behalf of taylor.centers at gmail.com> wrote:
>
>
>
> >I'm trying to get my ldap database associated with the users in the
> salesforce account, but no identifying information is being sent up with
> the assertion.  The Subject, NameID is a random transient value, and I
> couldn't figure out how to make it a persistent
> > hash of user data. I tried changing saml-nameid.xml and
> saml-nameid.properties with no results, the entire NameID block would
> disappear from the assertion if I tried changing it.
>
> Well, I can't do more than point you at the documentation. If you have a
> specific question about any of what the documentation tells you to change,
> just ask.
>
> But before I point at any docs, I have to know the use case. Are you
> absolutely certain you're needing to use a SAML persistent ID with
> Salesforce? I very much doubt that. I don't think you can in fact.
>
> >Below is what I think the relevant files and fields for adding an
> attribute to the assertion, in my case the user's email.
>
> A NameID and an Attribute are not the same. I don't know which Salesforce
> requires. My recollection is they allow for either, but I'm not sure.
>
> >But I am seeing no effect.  The logs look like it is getting the 'mail'
> attribute or at least parses the configuration properly, but I the array
> for included attributes is empty.
>
> No, it's not (as Tom noted). If you have logs indicating the assertion
> doesn't contain any Attributes, then the resolver is the problem. But that
> log is showing nothing, it's the startup log with no sign of actual use of
> the IdP yet.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151027/8d6435d9/attachment.html>