IDPv3 Attribute Resolver help

[Tim Williams]

On 15/11/16 14:08, Dave Perry wrote:
> I think this is what you need:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute
> 
> Basically you need to check the SP is set to receive any attributes from an IdP, before trying to get your webapp to see them.
> I speak having implemented Shibboleth SSO into moodle (a couple of years ago, but it was working on a test site).

The attribute mappings are all set up in the Moodle config and
Shibboleth is active as an authentication mechanism. Do I need to add
something to the Apache Shibboleth config as well to pass this through?

On 15/11/16 14:30, Cantor, Scott wrote:
>> In the Moodle code, the Shibboleth attributes are being looked for in
>> the PHP $_SERVER variable, eg for :
>>
>>         <AttributeRule attributeID="uid">
>>             <PermitValueRule xsi:type="ANY" />
>>         </AttributeRule>
>>
>> Should be read as $_SERVER['uid'].

That's where Moodle is looking for the attribute, the lack of it is
causing Moodle to complain. For non PHP people, $_SERVER contains
"Server and execution environment information". The Session ID and
various other Shib- parameters are present.

> If that's an IdP filter rule there, then that's simply not true. The
name of the attribute inside the IdP has nothing to do with its SAML
encoding on the wire, which in turn has nothing to do with how the SP
software on the other end exposes it to an application. If they match,
that's coincidental. It may be common, but it's not an assumption.

That's good to know. I'm debugging what's actually being sent into
Moodle by the Apache module and there is nothing there that contains the
data I was expecting.

> If this is a Shibboleth SP, which it appears to be (you said nothing
specifically), the first thing you do with a successful login is check
the /Shibboleth.sso/Session page to see what's getting cached from the
IdP and under what names. If they show up there, then they'll show up
for any protected resources. If not, they aren't being received at all,
or they weren't mapped by the SP into the session.

I'm running Moodle on Apache, with the Apache Shibboleth modules.  Sorry
if that wasn't fully clear. /Shibboleth.sso/Session reports no
attributes in the session.

Tim W


-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.