Problem with unscoped eppn - Shib SP and ADFS IdP

[Cantor, Scott]

On 9/25/15, 12:13 PM, "users on behalf of Cathy Scott" <users-bounces at shibboleth.net on behalf of cathystill at gmail.com> wrote:

>I've configured unscoped eppn.

There is no such thing. EPPN is defined by eduPerson. It is scoped.

In a SAML 2 assertion, that just means there are two first-order components in the string value and they both have meaning. If you don't want to apply that meaning (i.e. you don't want scope filtering), the fix is not to change the decoder, it's to alter the filter policy at the SP to skip the scope check.
 
>* These are the attribute-map entries for unscoped eppn using StringAttributeDecoder instead of ScopedAttributeDecoder:

Which you should not do.

>     <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" id="eppn" >

Well, I wouldn't do that either, but that's up to you.

>* I updated the attribute-policy to permit any eppn value:
>     <afp:AttributeRule attributeID="eppn"> 
> <afp:PermitValueRule xsi:type="ANY"/> 
>     </afp:AttributeRule>

That's the only change you should have to make. There's no reason to change the decoder.

> 
>* Transaction log show eppn value is getting successfully mapped.  It seems odd though that it shows up twice.

Because you mapped multiple attributes into that name/ID, and the IdP is obviously sending more than one input attribute 

-- Scott