unable to capture eppn information from SAML2/POST at SP

[O'Quinn, Dennis]

OK, I made it here pretty quick, but, I can't see that my application is getting the info it needs...  

>From shibd.log
2018-06-11 17:31:27 DEBUG Shibboleth.AttributeDecoder.String [2]: decoding SimpleAttribute (eppn) from SAML 2 Attribute (eppn) with 1 value(s)
2018-06-11 17:31:27 DEBUG Shibboleth.AttributeFilter [2]: filtering 1 attribute(s) from (https://devsaml.homedepot.com)
2018-06-11 17:31:27 DEBUG Shibboleth.AttributeFilter [2]: applying filtering rule(s) for attribute (eppn) from (https://devsaml.homedepot.com)
2018-06-11 17:31:27 DEBUG Shibboleth.SSO.SAML2 [2]: resolving attributes...

>From transaction.log
2018-06-11 17:31:27 INFO Shibboleth-TRANSACTION [2]: New session (ID: _2ca710ada158b75ab7fd70e18b57dbcf) with (applicationId: default) for principal from (IdP: https://devsaml.homedepot.com) at (ClientAddress: 130.211.3.65) with (NameIdentifier: dxo5ic1) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: l68aji3AUrXNW89kOzA6koEhwvE)
2018-06-11 17:31:27 INFO Shibboleth-TRANSACTION [2]: Cached the following attributes with session (ID: _2ca710ada158b75ab7fd70e18b57dbcf) for (applicationId: default) {
2018-06-11 17:31:27 INFO Shibboleth-TRANSACTION [2]:    eppn (1 values)
2018-06-11 17:31:27 INFO Shibboleth-TRANSACTION [2]: }


how can I see the 'value' being stored in eppn?  Also, how can I troubleshoot the REMOTE_USER variable on the session ????  per my session statement in shibboleth2.xml, it *should* be getting set by eppn (?)....

<ApplicationDefaults entityID="https://sascloud.homedepot.com/shibboleth"
                         REMOTE_USER="eppn persistent-id targeted-id eduPersonPrincipalName">


I am seeing the following session information....
Miscellaneous
Session Expiration (barring inactivity): 479 minute(s)
Client Address: 130.211.3.65
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: https://devsaml.homedepot.com
Authentication Time: 2018-06-11T21:31:28.202Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributes
eppn: 1 value(s)


However, I cannot find a way to 'see' the value in the eppn variable nor whether that value was propagated to the REMOTE_USER variable (which I suspect didn't happen since I am still not getting the expected response in my application)....

Thanks, Dennis



-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of O'Quinn, Dennis
Sent: Monday, June 11, 2018 4:45 PM
To: Shib Users <users at shibboleth.net>
Subject: [EXTERNAL] RE: unable to capture eppn information from SAML2/POST at SP

Well, I have made it this far now...

2018-06-11 16:28:45 DEBUG Shibboleth.AttributeDecoder.String [1]: decoding SimpleAttribute (eppn) from SAML 2 Attribute (eppn) with 1 value(s)
2018-06-11 16:28:45 DEBUG Shibboleth.AttributeFilter [1]: filtering 1 attribute(s) from (https://devsaml.homedepot.com)
2018-06-11 16:28:45 DEBUG Shibboleth.AttributeFilter [1]: applying filtering rule(s) for attribute (eppn) from (https://devsaml.homedepot.com)
2018-06-11 16:28:45 WARN Shibboleth.AttributeFilter [1]: removed value at position (0) of attribute (eppn) from (https://devsaml.homedepot.com)
2018-06-11 16:28:45 WARN Shibboleth.AttributeFilter [1]: no values left, removing attribute (eppn) from (https://devsaml.homedepot.com)

The attribute map I am using to get this is....
   <Attribute name="eppn" id="eppn">
        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
    </Attribute>

So, now on to figuring out the filters....

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, June 11, 2018 2:34 PM
To: Shib Users <users at shibboleth.net>
Subject: [EXTERNAL] RE: unable to capture eppn information from SAML2/POST at SP

> No. You put the nameformat in the "name" parameter (XML attribute).

Read too fast myself, so the rule is in fact not what was intended. Using name="eppn" id="eppn" would basically work to hack in that particular rule (an absent nameFormat in the rule will match "unspecified").

-- Scott

-- 
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=MtgQEAMQGqekjTjiAhkudQ&r=mn6DeBt1nj8Oqx06pdIK0_n5EfK6FeVHgdjBNpchyro&m=EqgCqa3GK9ZMhqG6SmG14-xhAuM8EjiHF7wuN1gaR94&s=EdKLuPQ9vljOXHBr3KgsVyxy8jyalGjrDPLeo-RKuWs&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=MtgQEAMQGqekjTjiAhkudQ&r=mn6DeBt1nj8Oqx06pdIK0_n5EfK6FeVHgdjBNpchyro&m=z9HC5h8KllBowKeZrAiogvY2Y05wILbEEykzXHqIHeE&s=Kour3E02LOo_kcWj4MS5ORr9qs6Z_UVijPURGoRiGeY&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net