Problem with unscoped eppn - Shib SP and ADFS IdP

[Cathy Scott]

Hello,

I'm hoping that someone can tell me what I've done wrong here.  Running
Shibboleth SP 2.5.5.1.  IdP is ADFS 2.0.  They have set us up as Relying
Party and added custom claim rules for UPN. Though transaction logs show
that eppn value is getting successfully mapped, when I log in the
application has missing icons and broken functionality. Additionally,
ability to get he Sign On screen is intermittent.  I've configured unscoped
eppn. Here are some additional details:

* This is the custom claim rule added in ADFS:
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]
=> issue(Type = "urn:oid:1.3.6.1.4.1.5923.1.1.1.6", Value = c.Value,
Properties["
http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/attributename"]
= "urn:oasis:names:tc:SAML:2.0:attrname-format:uri");

* These are the attribute-map entries for unscoped eppn using
StringAttributeDecoder instead of ScopedAttributeDecoder:

     <Attribute name="
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" id="eppn" >
    <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false" />
    </Attribute>

    <Attribute name="
http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"
id="eppn" >
    <AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
    </Attribute>

    <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName"
id="eppn">
        <AttributeDecoder xsi:type="StringAttributeDecoder"/>
    </Attribute>
    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">
        <AttributeDecoder xsi:type="StringAttributeDecoder"/>
    </Attribute>

* I updated the attribute-policy to permit any eppn value:

     <afp:AttributeRule attributeID="eppn">
 <afp:PermitValueRule xsi:type="ANY"/>
     </afp:AttributeRule>

* Transaction log show eppn value is getting successfully mapped.  It seems
odd though that it shows up twice.

2015-09-24 16:15:00 INFO Shibboleth-TRANSACTION [3]: New session (ID:
_5a988eb35da0f02c51ef4a367eda9c00) with (applicationId: default) for
principal from (IdP: http://fs.clientsite.org/adfs/services/trust) at
(ClientAddress: 72.xx.xxx.xxx) with (NameIdentifier: none) using (Protocol:
urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID:
_b9f3d057-4682-430d-983e-09b8afc40ff8)
2015-09-24 16:15:00 INFO Shibboleth-TRANSACTION [3]: Cached the following
attributes with session (ID: _5a988eb35da0f02c51ef4a367eda9c00) for
(applicationId: default) {
2015-09-24 16:15:00 INFO Shibboleth-TRANSACTION [3]:  eppn (1 values)
2015-09-24 16:15:00 INFO Shibboleth-TRANSACTION [3]:  eppn (1 values)
2015-09-24 16:15:00 INFO Shibboleth-TRANSACTION [3]: }

* Shibd log is skipping the attribute because it is unscoped. I think
that's normal.  Though two WARN entries, log says the new session was
created.

2015-09-24 16:15:00 INFO Shibboleth.AttributeExtractor.XML [3]: skipping
unmapped SAML 2.0 Attribute with Name:
http://schemas.xmlsoap.org/claims/Group,
Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
2015-09-24 16:15:00 WARN Shibboleth.AttributeFilter [3]: removed value at
position (0) of attribute (affiliation) from (
http://fs.clientsite.org/adfs/services/trust)
2015-09-24 16:15:00 WARN Shibboleth.AttributeFilter [3]: no values left,
removing attribute (affiliation) from (
http://fs.clientsite.org/adfs/services/trust)
2015-09-24 16:15:00 INFO Shibboleth.SessionCache [3]: new session created:
ID (_5a988eb35da0f02c51ef4a367eda9c00) IdP (
http://fs.clientsite.org/adfs/services/trust)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (72.xx.xxx.xxx)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150925/777fec97/attachment.html>