unable to capture eppn information from SAML2/POST at SP

[Peter Schober]

* O'Quinn, Dennis <DENNIS_OQUINN at homedepot.com> [2018-06-11 20:19]:
>                 <saml:Attribute Name="eppn" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
>                     <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">dxo5ic1</saml:AttributeValue>
>                 </saml:Attribute>

1. "eppn" is not the correct name (that would be
"urn:oid:1.3.6.1.4.1.5923.1.1.1.6"), at least if you meant
http://macedir.org/specs/eduperson/#eduPersonPrincipalName

2. Also, "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" is not
the correct nameformat to use, it should be
"urn:oasis:names:tc:SAML:2.0:attrname-format:uri".

(1 and 2 according to
http://macedir.org/docs/internet2-mace-dir-saml-attributes-latest.pdf )

3. eduPersonPrincipalName is defined to be scoped, as in
"foo at example.org", so the attribute value is also wrong.

So Name wrong, NameFormat wrong, AttributeValue wrong.
Other than that it's technically correct, i.e., it's valid SAML, but
it will not interoperate with anyone.

> <Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map"
>     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>     xsi:schemaLocation="urn:mace:shibboleth:2.0:attribute-map
>     /usr/share/xml/shibboleth/shibboleth-2.0-attribute-map.xsd"
>     REMOTE_USER="eppn">

The attribute map has no REMOTE_USER XML attribute, you're mixing that
up with the shibboleth2.xml config file. Did you try The Fine
Documentation?

> <Attribute name="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" id="eppn">
>   <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="true"/>
> </Attribute>

No. You put the nameformat in the "name" parameter (XML attribute).
Also the attribute your IDP sends is not scoped, so the scoped decode
would through it out, if it ever matched (which it doesn't).

> NOTE: I am using the following in my Apache conf to rewrite the
> header from REMOTE_USER to x-Remote-User for the application....

What kind of application using what technology? You shouldn't need to
put attributes into Request Headers.

-peter