Configuring Attributes for SAML 2.0 and ADFS 3.0

[Peter Schober]

* Franz Noel Tanglao <ftanglao at musicreports.com> [2016-11-12 01:38]:
> How would I configure the `attribute-map.xml` and
> `attribute-policy.xml` to be recognized by my Shibboleth SP? Can you
> give me examples based on the emailaddress, givenname, name, and
> groupsid?

You would have to speficy the formal name (and possibly nameformat)
for each attribute as its being written in the actual SAML assertion,
i.e., in the XML sent.

If ADFS has no way of showing you what exactly is going out over the
wire you can turn up logging at the SP and also log the recieved (and
decoded and decrypted, if applicable) XML.

If you're not encrypting the assertion (or reponse) you could also
grab the XML from the browser during a login attempt to the SP,
e.g. using Firefox's SAMLtracer extension.

I don't speak MS claims language but if I had to guess from your
example maybe it would be as simple as this (lines to add to your
attribute-map.xml), essentially reversing the process from ADFS:

<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" id="mail"/>
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" id="givenName"/>
<Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" id="displayName"/>
<Attribute name="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" id="o"/>

Where "name" is the formal attribute name on the wire (in the XML) and
"id" is the name of your chosing for how you want to expose that
attribute to the web server environment.

Note that unless you've set reloadChanges="true" on your attribute map
extractor (cf. shibboleth2.xml) you'll have to restart shibd after
making changes to the attribute-map.xml for them to become active.

-peter