AD attributes in assertion to SP

[Kishore Basa]

Thanks Peter , I was not aware to enable the ldap-attribute resolver conf in services.
Enabling that I was able to pass the information to the service Provider.

Now I would also like to pass the upn attribute from AD.
Can I define something like this in my attribute-resolver.xml  ?


<resolver:AttributeDefinition id="UserPrincipalName" xsi:type="ad:Simple" sourceAttributeID="UserPrincipalName">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" friendlyName=" UserPrincipalName " encodeType="false" />
    </resolver:AttributeDefinition>	



I tried this and it doesn't seem to pass any values.

Thanks
Kishore

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Thursday, October 27, 2016 5:37 PM
To: users at shibboleth.net
Subject: Re: AD attributes in assertion to SP

* Kishore Basa <Kishore.Basa at infor.com> [2016-10-27 23:00]:
> Attributes from AD are not passed in the assertion , no errors seen in 
> logs.  Could someone point me to what is missing.

Turn up logging to DEBUG for the resolver (and or filter), that will tell you exactly when and why they're dropped. E.g. for "net.shibboleth.idp.attribute", which will cover both .resolver and .filter classes.

> I configured the attribute-resolver-ldap.xml  to fetch few attributes from AD.  Added below lines.

Did you configure the IDP to use that specific resover file attribute-resolver-ldap.xml, though?

$ fgrep resolver conf/services.xml
        <value>%{idp.home}/conf/attribute-resolver.xml</value>

-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net