Issue with releasing eduPersonPrincipalName to Specific SP

[Edward Patri]

Hello All,

Hopefully somebody can assist me with this issue I've been having. We are trying to release eduPersonPrincipalName to Hobsons Retain. We have exchange Metadata and configured everything on our end but the SP is reporting that they are not receiving the eduPersonPrincipalName. 

​​​​​They are stating that there is no attribute statement in our meta data. 

Below is the log that they provided us

<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_5dce49d12c95b85f8a7f75ed17848f5a" IssueInstant="2017-04-25T18:34:47.457Z" Version="2.0"> 
<saml2:Issuer>https://idp.csi.cuny.edu/idp/shibboleth</saml2:Issuer> 
<saml2:Subject> 
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp.csi.cuny.edu/idp/shibboleth" SPNameQualifier="https://services02.askadmissions.net/shibboleth/sp">AAdzZWNyZXQxW8H8AopFae5vjT7CNeAG3g5lUtiOH2UXZhm2G9I4bnfZo4gD9f9OSr6aaMpGMm1BOSwULdX8wBx6DASwzWiQ6AOofS3GArojoMUxsoRNmQ+xuu5h/ZtNJdZlKGDi1yVh8KsRdn3Jf8VMuhJA1ops7C7G4T6DiOAFjm9DQ5dAy4nJCwvY8FO19khQ0kOk</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> 
<saml2:SubjectConfirmationData Address="66.161.171.254" InResponseTo="_afd1aa10f7c81b9f5b796032a4d88bd6" NotOnOrAfter="2017-04-25T18:39:47.467Z" Recipient="https://services02.askadmissions.net/shibboleth/Shibboleth.sso/SAML2/POST" /> 
</saml2:SubjectConfirmation> 
</saml2:Subject> 
<saml2:Conditions NotBefore="2017-04-25T18:34:47.457Z" NotOnOrAfter="2017-04-25T18:39:47.457Z"> 
<saml2:AudienceRestriction> 
<saml2:Audience>https://services02.askadmissions.net/shibboleth/sp</saml2:Audience> 
</saml2:AudienceRestriction> 
</saml2:Conditions> 
<saml2:AuthnStatement AuthnInstant="2017-04-25T18:34:47.383Z" SessionIndex="_660ed0bd4babb27212438cfa890cb04c"> 
<saml2:SubjectLocality Address="66.161.171.254" /> 
<saml2:AuthnContext> 
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef> 
</saml2:AuthnContext> 
</saml2:AuthnStatement> 
</saml2:Assertion>

017-04-25 14:34:47 DEBUG Shibboleth.SSO.SAML2 [1]: extracting pushed attributes... 
2017-04-25 14:34:47 DEBUG Shibboleth.AttributeExtractor.XML [1]: unable to extract attributes, unknown XML object type: saml2p:Response 
2017-04-25 14:34:47 DEBUG Shibboleth.AttributeExtractor.XML [1]: skipping unmapped NameID with format (urn:oasis:names:tc:SAML:2.0:nameid-format:transient) 
2017-04-25 14:34:47 DEBUG Shibboleth.AttributeExtractor.XML [1]: unable to extract attributes, unknown XML object type: saml2:AuthnStatement 
2017-04-25 14:34:47 DEBUG Shibboleth.SSO.SAML2 [1]: resolving attributes... 
2017-04-25 14:34:47 DEBUG Shibboleth.AttributeResolver.Query [1]: attempting SAML 2.0 attribute query 
2017-04-25 14:34:47 WARN Shibboleth.AttributeResolver.Query [1]: no SAML 2 AttributeAuthority role found in metadata


However, when I check our configuration using AACLI it shows that the attribute is being sucessfully released to their SP.

Below is a snipit of our configs.

Attribute-Filter.xml

<!-- Release to Hobsons -->

<AttributeFilterPolicy id="Hobsons">
        <PolicyRequirementRule xsi:type="Requester" value="https://services02.askadmissions.net/shibboleth/sp" />
<AttributeRule attributeID="eduPersonPrincipalName">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
</AttributeFilterPolicy>	


Attribute-resolver.xml

<resolver:AttributeDefinition xsi:type="ad:Simple" id="eduPersonPrincipalName" sourceAttributeID="userPrincipalName">
    <resolver:Dependency ref="myLDAP" />
    <resolver:Dependency ref="myLDAP2" />
    <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" />
    </resolver:AttributeDefinition>


Metadata-providers.xml

<MetadataProvider id="HTTPMetadataHobsons"
                  xsi:type="FileBackedHTTPMetadataProvider"
                  backingFile="C:\Program Files (x86)\Shibboleth\IdP\metadata\Hobsons.xml"
                  metadataURL="https://services02.askadmissions.net/shibboleth/sp"/>

Below is the output from the aacli 

C:\Program Files (x86)\Shibboleth\IdP\bin>aacli.bat --configDir=conf/ --principal=hobson.student at cix.csi.cuny.edu --requester=https://services02.askadmissions.net/shibboleth/sp

{
"requester": "https://services02.askadmissions.net/shibboleth/sp",
"principal": "hobson.student at cix.csi.cuny.edu",
"attributes": [
  {
    "name": "eduPersonPrincipalName",
    "values": [
              "StringAttributeValue{value=Hobson.Student at cix.csi.cuny.edu}"
     ]
  }

]
}



C:\Program Files (x86)\Shibboleth\IdP\bin>aacli.bat --configDir=conf/ --principal=hobson.student at cix.csi.cuny.edu --requester=https://services02.askadmissions.net/shibboleth/sp --saml2 <?xml version="1.0" encoding="UTF-8"?> <saml2:Assertion ID="_623e73d6a0cfee0c4694517fe9868113"
    IssueInstant="2017-04-24T16:34:57.188Z" Version="2.0" xmlns:saml2="urn:oasis :names:tc:SAML:2.0:assertion">
    <saml2:Subject>
        <saml2:NameID
            Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
            NameQualifier="https://idp.csi.cuny.edu/idp/shibboleth" SPNameQualif ier="https://services02.askadmissions.net/shibboleth/sp">AAdzZWNyZXQxLs6sWmSDgDp
1GtYsDTK9YKOW6A0mR5LOBCb1Eg/Rvw2EbYD9dPWcF/m6Ep+ZkrsC1dC/SPqcNrHJbVsx+pqUbnMBm9X
+tjgVZOUW549lsFVFAVgBphYX+oQoKrOTjyatvG/Yfo1D8NPJQYtW5GNBmlCcn3LaaqKPvIF
+tjgVZOUW549lsFVFAVgBphYX++tBFD6nT
355Hu0vcP0HvZ25Ne</saml2:NameID>
    </saml2:Subject>
</saml2:Assertion>


Any advise would be greatly appriciated as I have no idea what else to do. 

Edward Patri
Networking Services
CUNY - College of Staten Island
2800 Victory Blvd 2A-300
Staten Island, NY 10314
Office: (718) 982-2705
Edward.Patri at csi.cuny.edu