Problem with unscoped eppn - Shib SP and ADFS IdP

[Cathy Scott]

Thank you Scott,

Yes, changing the decoder back to ScopedAttributeDecoder resolved the
issue.  This is a dedicated environment and will never have any other IdP
authenticating in the environment.  I do want to employ best practice.  May
I ask what the risk is and why you would not make these changes?  Is there
a better way to integrate with ADFS IdP?

Thanks again,
Cathy

On Fri, Sep 25, 2015 at 9:32 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/25/15, 12:13 PM, "users on behalf of Cathy Scott" <
> users-bounces at shibboleth.net on behalf of cathystill at gmail.com> wrote:
>
> >I've configured unscoped eppn.
>
> There is no such thing. EPPN is defined by eduPerson. It is scoped.
>
> In a SAML 2 assertion, that just means there are two first-order
> components in the string value and they both have meaning. If you don't
> want to apply that meaning (i.e. you don't want scope filtering), the fix
> is not to change the decoder, it's to alter the filter policy at the SP to
> skip the scope check.
>
> >* These are the attribute-map entries for unscoped eppn using
> StringAttributeDecoder instead of ScopedAttributeDecoder:
>
> Which you should not do.
>
> >     <Attribute name="
> http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" id="eppn" >
>
> Well, I wouldn't do that either, but that's up to you.
>
> >* I updated the attribute-policy to permit any eppn value:
> >     <afp:AttributeRule attributeID="eppn">
> > <afp:PermitValueRule xsi:type="ANY"/>
> >     </afp:AttributeRule>
>
> That's the only change you should have to make. There's no reason to
> change the decoder.
>
> >
> >* Transaction log show eppn value is getting successfully mapped.  It
> seems odd though that it shows up twice.
>
> Because you mapped multiple attributes into that name/ID, and the IdP is
> obviously sending more than one input attribute
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150925/85c08f99/attachment.html>