eliminating warnings for unscoped attributes
csross
cross at hccs.com
Wed Jan 20 12:31:52 EST 2016
I was looking at the shibd.logs on my SP from a client that has a simplsaml
IDP. The users have no problems logging in but I see one or two warning
messages with each login attempt.
I have been researching and checking other posts but I want to understand
what to tell the IDP to change to eliminate the error. I don't see these
warnings for other IDPs. I believe/think the warning means that since it
was not a scoped attribute (@site.com), shibboleth dropped it?
SHIBD WARN
2016-01-19 14:59:22 WARN Shibboleth.AttributeFilter [2]: removed value at
position (0) of attribute (unscoped-affiliation) from
(http://site.site.edu/simplesaml-coi/saml2/idp/metadata.php)
2016-01-19 14:59:22 WARN Shibboleth.AttributeFilter [2]: no values left,
removing attribute (unscoped-affiliation) from
(http://site.site.edu/simplesaml-coi/saml2/idp/metadata.php)
I see in my attribute.map the unscoped-affiliation entry, and I believe the
shibd.log entry (below) shows that field coming over. I know there are lots
of posts but I don’t definitely know what to suggest to the client in order
to eliminate it. Is it as simple as saying “don’t send that attribute”? I
see they are sending many unmapped attributes that are not generating
warnings.
SHIBD LOG
..
<saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue
xsi:type="xs:string">Consultant</saml:AttributeValue></saml:Attribute>
..
ATTRIBUTE MAP
<Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation"
id="unscoped-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
id="unscoped-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder"
caseSensitive="false"/>
</Attribute>
Thank you
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/eliminating-warnings-for-unscoped-attributes-tp7621955.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
More information about the users
mailing list