Shibboleth IdP not passing AD LDAP attributes to TestShib SP

[Peter Schober]

* James, Todd R. <trj at h2law.com> [2017-12-12 22:28]:
> I can successfully authenticate via LDAP (on Active Directory) with
> my email address and it seems that the LDAP attributes are being
> returned successfully according to ldaptive DEBUG logs, but the
> attributes are not being passed back to the SP.

You'll need to decompose this process into its individual steps:
authn, gathering attributes from LDAP, releasing them to the SP, and
(with your own SPs) preparing the SP to recieve/map/process them.

> FWIW, I would prefer to use sAMAccountName as the canonical username
> for our users, but allow them to authenticate using any email alias
> on their account. In other applications, finding the correct account
> by email address is done using a query like this in AD:
> (proxyAddresses=smtp:EMAIL_ADDRESS)
> 
> Logs from idp-process.log: https://pastebin.com/CLwMh4Yx

There's an impossible amount of noise in there due to you logging on
DEBUG but from just this in the first "line":
  filter=(proxyAddresses=smtp:{user}), parameters={user=myemail at ourdomain.com}
and this in the next:
  result=...entries=[[dn=CN=James\, Todd,OU=Our Users,DC=ourdomain,DC=local[], ... resultCode=SUCCESS,
this seems this works fine, at least for authn.
See also
  "authenticate response= ... resultCode=SUCCESS
in the next line.

So I'd suggest to switch your logging config back to the defaults and
simply check what your idp-process.log and idp-audit.log shows for a
login attempt.

Since Matthew has already shown that your attribute filter is wrong
(the "requester" should be the SP) maybe that's all that needed
fixing? Then digging through heaps of LDAP debug logs won't help.

As a general rule: (Only) Once authentication (with a test SP) works
successfully with all the various (username, email address, UPN, etc.)
string formats you want to support you can move on to attribute
resolving and releasing. For the latter it's easiest doing this using
the 'aacli'. E.g.
/opt/shibboleth-idp/bin/aacli.sh --saml2 -n youremail at youdomain.com -r https://sp.testshib.org/shibboleth-sp

Cheers,
-peter