AW: IdP does not release attributes

[Riebeling, Sebastian]

Which log-files do you need? All files or is the process one enough?


I just discovered a - in my opinion - weird thing. The "shib2.xml" defines the entityID of my SP as:


 <ApplicationDefaults entityID="https://sso-med1.imib.rwth-aachen.de/shibboleth"
                         homeURL="https://sso-med1.imib.rwth-aachen.de/Shibboleth.sso/Session" (...)


or



        <SSO entityID="https://sso-med1.imib.rwth-aachen.de/shibboleth">
              SAML2 SAML1
            </SSO>


but in the metadata of the SP is the entitID given as:


<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" (..) entityID="https://sso-med1.imib.rwth-aachen.de">


shouldn't these IDs match?



the attachment is my idp-process.log




________________________________
Von: users <users-bounces at shibboleth.net> im Auftrag von rdw at steadingsoftware.com <rdw at steadingsoftware.com>
Gesendet: Samstag, 29. Juli 2017 12:36
An: Shib Users
Betreff: Re: IdP does not release attributes

Sebastian,
You. We'd to look very closely at the IdP logs, you might find it useful to turn up the attribute filter logs to DEBUG.


value="https://sso-med1.imib.rwth-aachen.de"

Is that really the entityID of your SP? It's valid, but it's more usual for to have something after the host name.  You should check this in the metadata for the SP that you gave the to the IdP....

Sent from my iPad

On 29 Jul 2017, at 10:36, Riebeling, Sebastian <sebastian.riebeling at rwth-aachen.de<mailto:sebastian.riebeling at rwth-aachen.de>> wrote:


Hello,


I am currently trying to set up an IdP and SP on a Debian machine. The credentials are stored and provided by an LDAP Server. I can successfully log-in, but the IdP doesen't release any attribute. The list on /Shibboleth.sso/Session and the transaction.log file from the SP show no incoming attributes.  I think my SP configuration should be ok. I tested it with testshib.org<http://testshib.org> and their attributes are in the SPs transaction.log.

At the moment I am just trying to release one easy Attribute to my SP which is not even stored in LDAP. (In my understanding this is the username I type into the log-in form on the webpage, isn't it?)


from "attribute-resolver.xml":


 <resolver:AttributeDefinition id="uid" xsi:type="ad:PrincipalName">
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" />
    </resolver:AttributeDefinition>




The first times the IdP "warned" me that it will release other informations to the SP than last time and I had to accept this info, but nevertheless the transaction.log stays empty.

I use the standard "attribute-filter.xml" file and only changed the value to my SP (and the id):


<!-- Release some attributes to an SP. -->
    <AttributeFilterPolicy id="SSOMED">
        <PolicyRequirementRule xsi:type="Requester" value="https://sso-med1.imib.rwth-aachen.de" /> The

        <AttributeRule attributeID="eduPersonPrincipalName">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="uid">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

        <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>



Do I have to change other things for a basic attribute release? Do you need the whole file or other files to help me?

It is my first time working with Shibboleth and I actually don't have any experience in this field at all. So I would be glad for any tips and recommendations you can give me.


Thank you for your time and I hope you can help me.



kind regards,

Sebastian



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170729/117797e5/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: process
Type: application/octet-stream
Size: 14179 bytes
Desc: process
URL: <http://shibboleth.net/pipermail/users/attachments/20170729/117797e5/attachment-0001.obj>