Custom Attribute definitation
Santu Ghosh
mon.snahasish at gmail.com
Mon Nov 27 10:46:49 EST 2017
Hi Stephen, peter and Rob
Thanks for your reply.
As per your suggection I have modified my attribute-resolver.xml file with
bellow changes.
<AttributeDefinition xsi:type="Simple" id="realm"
sourceAttributeID="realmval">
<Dependency ref="realmRef" />
<AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:realm" encodeType="false" />
<AttributeEncoder xsi:type="SAML1String"
name="urn:unsolicited:realm" friendlyName="realm" encodeType="false" />
</AttributeDefinition>
<DataConnector id="realmRef" xsi:type="Static" >
<Attribute id="realmval">
<Value>XYZ</Value>
</Attribute>
</DataConnector>
But getting bellow error:
2017-11-27 15:42:50,130 - ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:181]
- Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
38 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver-full.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 38; columnNumber:
125; cvc-complex-type.3.2.2: Attribute 'friendlyName' is not allowed to
appear in element 'AttributeEncoder'.
at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:336)
Caused by:
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line
38 in XML document from file
[/opt/shibboleth-idp/conf/attribute-resolver-full.xml] is invalid; nested
exception is org.xml.sax.SAXParseException; lineNumber: 38; columnNumber:
125; cvc-complex-type.3.2.2: Attribute 'friendlyName' is not allowed to
appear in element 'AttributeEncoder'.
at
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.3.2.2: Attribute
'friendlyName' is not allowed to appear in element 'AttributeEncoder'.
at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)
2017-11-27 15:42:50,130 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:183]
- Service 'shibboleth.AttributeResolverService': Continuing to poll
configuration
It seems that name="urn:unsolicited:oid:realm" is not correct/supported by
SAML. Can you please help..
Snahasish
On Fri, Nov 24, 2017 at 8:28 PM, Losen, Stephen C. (scl) <scl at virginia.edu>
wrote:
> To create attributes with “constant” or “static” values, look at the
> Static DataConnector. You will also need to make an AttributeDefinition for
> the attribute, and this will be a “Simple” AttributeDefinition whose source
> attribute ID is defined in your Static DataConnector. And the Dependency
> will be the ID that you give your Static DataConnector.
>
>
>
> https://wiki.shibboleth.net/confluence/display/IDP30/StaticDataConnector
>
>
>
> https://wiki.shibboleth.net/confluence/display/IDP30/
> SimpleAttributeDefinition
>
>
>
> Both of these will go in your attribute-resolver.xml file.
>
>
>
> Stephen C. Losen
>
> ITS - Systems and Storage
>
> University of Virginia
>
> scl at virginia.edu 434-924-0640 <(434)%20924-0640>
>
>
>
> *From:* users [mailto:users-bounces at shibboleth.net] *On Behalf Of *Santu
> Ghosh
> *Sent:* Friday, November 24, 2017 9:48 AM
> *To:* Shib Users <users at shibboleth.net>
> *Subject:* Re: Custom Attribute definitation
>
>
>
> Thanks Rod and Peter.
>
>
>
> Please my apologies for incomplete description.
>
>
>
> Sure I will keep in mind everything that you guys advised.
>
>
>
> Thanks a lot.
>
>
>
> On 24 Nov 2017 19:29, "Peter Schober" <peter.schober at univie.ac.at> wrote:
>
> * Santu Ghosh <mon.snahasish at gmail.com> [2017-11-24 13:35]:
>
> > To do this I have done in :
> >
> > 1) attribute-resolver-full.xml
>
> [...]
> > 2) attribute-resolver-ldap.xml
>
> None of these files are being used by the IDP by default, only
> attribute-resolver.xml is. The files you changed are merely examples
> (none of which you are following, so this is doubly useless).
>
>
> > <AttributeDefinition xsi:type="Mapped" id="AREA">
> > <DefaultValue>USA</DefaultValue>
> > <ValueMap>
> > <ReturnValue>USA</ReturnValue>
> > <SourceValue>USA</SourceValue>
> > </ValueMap>
>
> What should mapping "USA" to "USA" accomplish?
>
>
> > <AttributeDefinition xsi:type="Simple" id="AREA">
> > <DefaultValue>USA</DefaultValue>
> > <ValueMap>
> > <ReturnValue>USA</ReturnValue>
> > <SourceValue>USA</SourceValue>
> > </ValueMap>
>
> Obviously (?) a "Simple" attribute defintion is not a mapped attribute
> defintion and therefore cannot have a ValueMap.
>
> Nothing you're doing here makes any sense. If the existing
> documentation doesn't help you can ask specific questions about parts
> that are unclear.
>
>
> > 3) ldap.properties
> >
> > idp.attribute.resolver.LDAP.returnAttributes =
> ou,uid,mail,surname,realm
>
> The fact that you limit your default LDAP query to these attributes
> does not influence anything you're doing above. So this is immaterial
> unless you (later) want to generate something based on data from LDAP.
>
>
> > 4) global.xml
> >
> > <bean id="abc" class="java.lang.String">
> > <constructor-arg value="USA"/>
> > </bean>
> >
> > <bean id="AREA" class="java.lang.String">
> > <constructor-arg value="USA"/>
> > </bean>
>
> Could you point out the documentattion that suggests this?
>
> To answer the (not asked) question of how to produce an attribute with a
> static string as its value:
>
> * You define a "Static" data connector that has an Attribute as child
> element, with an id of your choice, and a Value child element with
> the static string value.
>
> * You define a "Simple" attribute with a uniquie id and the
> sourceAttributeID set to the id of the attribute you defined in the
> Data COnnector. Also add a Dependency element to reference the data
> connector.
>
> To release the attribute you write a filter rule referencing the id of
> the attribute you dedined, as always.
>
>
> > but above setting ends with an error.
>
> No doubt. But for the future you'll also need to be specific and
> provide the error message. We do not have access to your system (nor
> do we want to) and most of us here are not clairvoyant.
>
> -peter
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
--
Snahasish Ghosh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171127/9cb443f2/attachment-0001.html>
More information about the users
mailing list