unable to capture eppn information from SAML2/POST at SP

[Domingues, Michael D]

Hi Dennis,


The "name" attribute on the entry in your attribute-map.xml file needs to exactly match what the desired attribute is being encoded as in the SAML assertion. In the config listed below, you're encoding the attribute as "eppn" but trying to capture it as "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified".


Michael

________________________________
From: users <users-bounces at shibboleth.net> on behalf of O'Quinn, Dennis <DENNIS_OQUINN at homedepot.com>
Sent: Monday, June 11, 2018 1:17:36 PM
To: Shib Users
Subject: unable to capture eppn information from SAML2/POST at SP


Hi, having trouble figuring out how to map the desired value from the SAMLResponse in Shibboleth.



I have my IdP returning:

<SAMLResponse>

.

.

.

        <saml:Assertion ID="teAnsub-RcnQBOVPwdN_64zAz62" IssueInstant="2018-06-11T17:56:31.648Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">

            <saml:Issuer>https://devsaml.homedepot.com</saml:Issuer>

            <saml:Subject>

                <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">dxo5ic1</saml:NameID>

                <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">

                    <saml:SubjectConfirmationData Recipient="https://sascloud.homedepot.com/Shibboleth.sso/SAML2/POST" NotOnOrAfter="2018-06-11T18:11:31.648Z" InResponseTo="_0aa24f12eb976fcc40d3cfd08077b0d3"/>

                </saml:SubjectConfirmation>

            </saml:Subject>

            <saml:Conditions NotBefore="2018-06-11T17:46:31.648Z" NotOnOrAfter="2018-06-11T18:11:31.648Z">

                <saml:AudienceRestriction>

                    <saml:Audience>https://sascloud.homedepot.com/shibboleth</saml:Audience>

                </saml:AudienceRestriction>

            </saml:Conditions>

            <saml:AuthnStatement SessionIndex="teAnsub-RcnQBOVPwdN_64zAz62" AuthnInstant="2018-06-11T17:56:31.648Z">

                <saml:AuthnContext>

                    <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>

                </saml:AuthnContext>

            </saml:AuthnStatement>

            <saml:AttributeStatement>

******************************************************************************************************************************

                <saml:Attribute Name="eppn" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">

                    <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">dxo5ic1</saml:AttributeValue>

                </saml:Attribute>

******************************************************************************************************************************

            </saml:AttributeStatement>

        </saml:Assertion>

    </samlp:Response>

</SAMLResponse>



I have tried numerous mapping statements in my attribute-map.xml, but, I can get nothing trapped and recorded in the transaction log as ‘cached’ nor is my application detecting the information I am hoping to pass to it.



I have simplified my attribute map to the following:

<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xsi:schemaLocation="urn:mace:shibboleth:2.0:attribute-map

    /usr/share/xml/shibboleth/shibboleth-2.0-attribute-map.xsd"

    REMOTE_USER="eppn">



    <Attribute name="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" id="eppn">

<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="true"/>

    </Attribute>

</Attributes>



Can someone advise me on what I am missing here and why I can’t seem to trap the eppn value (which I am hoping will populate REMOTE_USER in the headers)….



NOTE: I am using the following in my Apache conf to rewrite the header from REMOTE_USER to x-Remote-User for the application….

<Location /SASLogon/login>

  AuthType shibboleth

  ShibRequestSetting requireSession 1

  require valid-user

  RewriteEngine On

  RewriteCond %{LA-U:REMOTE_USER} (.+)

  RewriteRule . - [E=RU:%1]

  RequestHeader set X-Remote-User "%{RU}e" env=RU

</Location>



Thanks in advance, Dennis



Dennis O’Quinn | EDW Infrastructure Engineering | NAE115H @ 2250 MTC

The Home Depot | Marietta Technology Center | 2250 Newmarket Parkway | Marietta, GA  30067

•: Direct: 470.689.4513 | Cell: 470.658.1183 | Internal: 24513

•: doq at homedepot.com<mailto:doq at homedepot.com>

[cid:image002.jpg at 01D3A171.22570120]

We make a living by what we get , We make a life by what we give.

P  Please consider the environment before printing this email.






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180611/e1d6e847/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 2336 bytes
Desc: image002.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20180611/e1d6e847/attachment.jpg>