AW: IdP does not release attributes

[Riebeling, Sebastian]

Yes you are right with the entityID. I copied from an older-file and sent the mail a bit to quickly and was not concentrated. I am sorry for the inconvenience.
I also maybe didn't made my machine informations clear. I use two Debian machines, one with the IdP and one with the SP.
I also put a Discovery Service on the SP machine to decide which IdP to use.
The SP-machine's hostname is:  https://sso-med1.imib.rwth-aachen.de/
The IdP-machine's hostname is https://sso-med.imib.rwth-aachen.de/



the audit file says:
"20170802T130742Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_156755526f958ba2cc0bb2b07688a55b|https://sso-med1.imib.rwth-aachen.de/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://sso-med.imib.rwth-aachen.de/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_4e370320aecc5ccf63aad0d926320d08|sriebeling|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid|AAdzZWNyZXQxCUTtyC0Vk8A2PLEss5ICcjqfGGrJKwd963ooPT9oodpOcqHJy+vyMezGR/CGQKG5AnauIcU7wpyHFrXMXdBxMPs2ytL6CNLg5u1DinIXWlT2eC2dGfHOViLE5qGVF78JEO0VfQNE1+jbudE3kqxTtjUdgA472EUX|_525d64dd6240d65a34bebaa285e5eb81|"
________________________________________
Von: users <users-bounces at shibboleth.net> im Auftrag von Peter Schober <peter.schober at univie.ac.at>
Gesendet: Mittwoch, 2. August 2017 10:43
An: Shib Users
Betreff: Re: IdP does not release attributes

* Riebeling, Sebastian <sebastian.riebeling at rwth-aachen.de> [2017-07-29 15:22]:
> The "shib2.xml" defines the entityID of my SP as:
>
>  <ApplicationDefaults entityID="https://sso-med1.imib.rwth-aachen.de/shibboleth"
>                          homeURL="https://sso-med1.imib.rwth-aachen.de/Shibboleth.sso/Session" (...)
>
> or
>
>         <SSO entityID="https://sso-med1.imib.rwth-aachen.de/shibboleth">
>               SAML2 SAML1
>             </SSO>

The latter does not define your own entityID, it tells your SP what
IDP to use. You need to stop changing stuff you don't fully understand
and instead refer to the documentation. Trial-and-error will only
cause frustration with something as complex as this.

> I am currently trying to set up an IdP and SP on a Debian machine.

That probably adds to the confusion, of you have both on the same
machine, using the same hostname. (That's not a problem and not a
restrction of the software, it just makes your deployment more
confusion when you're only starting out. I.e., if the idea was to make
the first steps simpler this is not what you have achieved.)

* Riebeling, Sebastian <sebastian.riebeling at rwth-aachen.de> [2017-07-31 18:44]:
> I also turned the "net.shibboleth.idp" and
> "net.shibboleth.idp.attribute" up to DEBUG, in the "logback.xml". My
> resulting process is in the appendix (I cut out the attributes part
> after the session was created I hope this should be enough).

Well, that log snippet you sent ends all lines after 237 characters
(which sometime isn't enough with Shib, so when copying from a
terminal you need to take more care to include the full lines), but
from the last line with "net.shibboleth.idp.attribute.filter" it seems
the filter did not remove the attribute:

  Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for
  attribute 'uid' remained after filtering

What does your audit log say about attributes released in that
transaction? (By default those logs are also duplicated into your
process log but you didn't include that part in what you sent either.)

Also note that setting the logging of "net.shibboleth.idp" to DEBUG
will also include everything "below" it, including
net.shibboleth.idp.attribute.  So setting /both/ is redundant.
In this case you only want the latter (net.shibboleth.idp.attribute)
or possibly even only net.shibboleth.idp.attribute.filter.

-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: process
Type: application/octet-stream
Size: 36707 bytes
Desc: process
URL: <http://shibboleth.net/pipermail/users/attachments/20170802/648366bc/attachment-0001.obj>