Need assistance releasing Active Directory "employeeID" attribute

[Edward Patri]

Hi Scott,

I have configured our ldap.properties to return all attributes using the following command.

idp.attribute.resolver.LDAP.returnAttributes= *

I have removed the SAML1 string line and as for the SAML 2.0 isnt that line correct? 

I am using the aacli.bat script to test which attributes I am releasing to a certain SP and the employeeID attribute is not being released although it is configured to be released in the attribute-filter.xml file. 

I am still getting used to shibboleth and any assistance would be greatly appreciated. 

​​​​​

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, January 23, 2017 3:06 PM
To: Shib Users <users at shibboleth.net>
Cc: Stanley Tse <Stanley.Tse at csi.cuny.edu>
Subject: RE: Need assistance releasing Active Directory "employeeID" attribute

>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:employeeID" encodeType="false" />

You cannot make up names yourself like that, you don't own that namespace. And you don't need SAML 1.1 support, so don't worry about it. Its name in any case would be the same as in SAML 2.0.

As for the rest, you need to actually describe a specific problem to get help. What did the log tell you? You certainly didn't just change that alone? You can't manufacture an attribute out of thin air. If you tell it to get it from LDAP, then your LDAP connector has to retrieve it. Some people do a search for all attributes but many don't.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net