Using a custom attribute as the eppn

[Alexander Ivanov]

Hi all,

I'm the lead developer for QDR ( https://qdr.syr.edu/ ) and currently I'm
working on configuring SSO between our site, which is Drupal, and an
instance of Dataverse (http://dataverse.org/) which is set up on the same
server.

Dataverse has built-in support for Shibboleth, so I've configured it as a
Shibboleth SP.  To create an IdP integrated with our Drupal site I used
SimpleSamlPhp, because it has a module for Drupal integration.

I've successfully gotten the SP to authenticate against the IdP, and it
correctly receives the following attributes: uid, mail, givenName, sn, and
a custom attribute "roles".  However, Dataverse requires an eppn attribute
to be specified in order for the SSO integration to work.  We have a
database full of users who registered for the QDR site with a variety of
email addresses, many of which do not end in ".edu".  Therefore, by
definition, we do not have an eduPersonPrincipalName for each of our
users.  I'm attempting to use the users' email addresses as their  eppns.
Right now I've configured my IdP to send the users email address in an
attribute called "eppn"

I've tried editing *attribute-map.xml* to configure "eppn" to be a custom
attribute, the same way that I configured "roles":
<Attribute name="roles" id="roles"/>
<Attribute name="eppn" id="eppn"/>

This does not work.. In my log files I see the following:
2016-08-09 13:43:16 DEBUG Shibboleth.AttributeFilter [2]: filtering 6
attribute(s) from (https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 DEBUG Shibboleth.AttributeFilter [2]: applying
filtering rule(s) for attribute (sn) from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 DEBUG Shibboleth.AttributeFilter [2]: applying
filtering rule(s) for attribute (givenName) from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 DEBUG Shibboleth.AttributeFilter [2]: applying
filtering rule(s) for attribute (mail) from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 DEBUG Shibboleth.AttributeFilter [2]: applying
filtering rule(s) for attribute (uid) from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 DEBUG Shibboleth.AttributeFilter [2]: applying
filtering rule(s) for attribute (roles) from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 DEBUG Shibboleth.AttributeFilter [2]: applying
filtering rule(s) for attribute (eppn) from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 *WARN Shibboleth.AttributeFilter [2]: removed value at
position (0) of attribute (eppn)* from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)
2016-08-09 13:43:16 WARN Shibboleth.AttributeFilter [2]: no values left,
removing attribute (eppn) from (
https://stage.qdr.org/simplesaml/saml2/idp/metadata.php)

Is it possible to configure a custom attribute named "eppn", or does the
eppn have to be a .edu address?

Your advice is very much appreciated.

Thanks in advance,
Alex
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160809/44f29c0e/attachment.html>