how to add a non-single valued attribute, like memberOf

[Domingues, Michael D]

How are you determining that the attribute "isn't being sent"? Are you looking at your IdP logs to see what attributes are being released, inspecting the assertion "on-the-wire", or inspecting the attribute collection available at the SP?


Also, the attribute names you are using seem to be incorrect. As far as I can tell, that OID doesn't resolve to anything.


Michael

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Clayton <upnyhgb8v6 at snkmail.com>
Sent: Wednesday, November 8, 2017 4:05:51 PM
To: users at shibboleth.net
Subject: how to add a non-single valued attribute, like memberOf

We've got Shibboleth attached to ActiveDirectory and it's resolving single-valued attributes, like "sn", just fine.
But now I'm trying to add a list-type attribute, "memberOf", so that it can be sent to SPs and it isn't being sent.

I expected just adding these to attribute-resolver.conf and then adding it to the attribute-filter entry for an SP would do the trick, but it doesn't seem so:

<AttributeDefinition id="memberOf" xsi:type="Simple" sourceAttributeID="memberOf">
    <Dependency ref="myLDAP" />
    <AttributeEncoder xsi:type="SAML1String" name="urn:oid:1.3.6.1.4.1.1466.115.121.1.12" encodeType="false" />
    <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.1466.115.121.1.12" friendlyName="memberOf" encodeType="false" />
</AttributeDefinition>

Any tips?
Thanks in advance!
--Clayton
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171108/8f9e10d7/attachment.html>