IDPv3 Attribute Resolver help

[Tim Williams]

On 21/11/16 14:31, Cantor, Scott wrote:
>> Which lists the attribute names I was expecting. However, it's not clear
>> to me if this is confirming that the parameters were actually sent to
>> the SP or not.
> 
> It is confirming that.

Great, that's good to know.

>> The Apache Shib module is designed to pass through the attributes as
>> server environment variables (I have ShibUseEnvironment On in the
>> config), so the attributes should appear in the PHP $_SERVER global
>> variable. However, I'm not seeing the attributes. I've got apache
>> logging set to "debug", but there is nothing in the log which seems to
>> relate to attributes.
> 
> That is not where the SP logs are.
> 
> The shibd.log will report on any issues with mapping the attributes it received and if the session page doesn't show anything, then you either don't have anything mapped correctly or you aren't accessing the session page after a session is actually in place.

I hadn't noticed that, thanks. shibd.log is telling me this:

2016-11-21 14:39:06 INFO Shibboleth.AttributeExtractor.XML [145]:
skipping unmapped SAML 2.0 Attribute with Name:
urn:oid:0.9.2342.19200300.100.1.1
2016-11-21 14:39:06 INFO Shibboleth.AttributeExtractor.XML [145]:
skipping unmapped SAML 2.0 Attribute with Name:
urn:oid:0.9.2342.19200300.100.1.3
2016-11-21 14:39:06 INFO Shibboleth.AttributeExtractor.XML [145]:
skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.4
2016-11-21 14:39:06 INFO Shibboleth.AttributeExtractor.XML [145]:
skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.42

I've added the four unmapped attributes to /etc/shibboleth/attribute-map.xml

<Attribute name="urn:oid:2.5.4.4" id="sn"/>
<Attribute name="urn:oid:2.5.4.42" id="givenName"/>
<Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail"/>
<Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/>

Which finally seems to have solved this problem and caused the
parameters to pass through. Phew! Thanks again for your help.

Tim W



-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.