Issue with releasing eduPersonPrincipalName to Specific SP

[Brent Putman]

On 4/26/17 1:37 PM, Edward Patri wrote:
> ​​​​​They are stating that there is no attribute statement in our meta data. 

I think you mean no AttributeStatement in the Assertion, not metadata. 
The latter has a specific and different meaning in SAML.

>
> Below is the log that they provided us

Correct, there's no AttributeStatement there.

>
>
> However, when I check our configuration using AACLI it shows that the attribute is being sucessfully released to their SP.

Well, actually it doesn't.  There is no AttributeStatement there
either. See below.

>
> Below is the output from the aacli 
>
>
> C:\Program Files (x86)\Shibboleth\IdP\bin>aacli.bat --configDir=conf/ --principal=hobson.student at cix.csi.cuny.edu --requester=https://services02.askadmissions.net/shibboleth/sp --saml2 <?xml version="1.0" encoding="UTF-8"?> <saml2:Assertion ID="_623e73d6a0cfee0c4694517fe9868113"
>     IssueInstant="2017-04-24T16:34:57.188Z" Version="2.0" xmlns:saml2="urn:oasis :names:tc:SAML:2.0:assertion">
>     <saml2:Subject>
>         <saml2:NameID
>             Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
>             NameQualifier="https://idp.csi.cuny.edu/idp/shibboleth" SPNameQualif ier="https://services02.askadmissions.net/shibboleth/sp">AAdzZWNyZXQxLs6sWmSDgDp
> 1GtYsDTK9YKOW6A0mR5LOBCb1Eg/Rvw2EbYD9dPWcF/m6Ep+ZkrsC1dC/SPqcNrHJbVsx+pqUbnMBm9X
> +tjgVZOUW549lsFVFAVgBphYX+oQoKrOTjyatvG/Yfo1D8NPJQYtW5GNBmlCcn3LaaqKPvIF
> +tjgVZOUW549lsFVFAVgBphYX++tBFD6nT
> 355Hu0vcP0HvZ25Ne</saml2:NameID>
>     </saml2:Subject>
> </saml2:Assertion>
>


Following the saml2:Subject element, you should expect to see a
saml2:AttributeStatement element, containing at least one
saml2:Attribute with the eduPersonPrincipalName data.  There isn't,
which implies there's something wrong with your IdP configuration,
either your attribute resolver or maybe something else.  For example,
do your LDAP attribute sources actually have an attribute
'userPrincipalName', that is resolvable using the LDAP credentials and
search info you have configured?

If you can't solve by looking at the config along, then looking at your
IdP logs on DEBUG should help diagnose it.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170426/1d9e16f4/attachment.html>