[EXTERNAL] Re: unable to capture eppn information from SAML2/POST at SP

[O'Quinn, Dennis]

Hi Peter, yes, I found that.  In fact I set the loglevel in Apache to print out the activity I wanted to see which included seeing the setting of the RU environment variable I am setting.  Next step is to confirm that my 'RequestHeaders set' statement is being executed and doing what I want, but, that is Apache not Shibboleth.

RE: the name/id/eppn in the attribute map, yes, I did not understand which parm was setting what, but, Scott set me straight on that and I have switched it to name=eepn, id=eduPersonPrincipalName, and then updated the REMOTE_USER= parm on my Session stanza in shibboleth2.xml to reflect that.

I also restored all the filtering in attribute-policy.xml that I had had to remove to get it to work when using eppn as the id.

Thanks to all for your help.  Very responsive group...

D

Dennis O'Quinn | EDW Infrastructure Engineering | NAE115H @ 2250 MTC
The Home Depot | Marietta Technology Center | 2250 Newmarket Parkway | Marietta, GA  30067
M: Direct: 470.689.4513 | Cell: 470.658.1183 | Internal: 24513
e: doq at homedepot.com



-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober
Sent: Tuesday, June 12, 2018 4:18 AM
To: users at shibboleth.net
Subject: [EXTERNAL] Re: unable to capture eppn information from SAML2/POST at SP

* Brent Putman <putmanb at georgetown.edu> [2018-06-11 23:47]:
> >  nor whether that value was propagated to the REMOTE_USER variable
> (which I suspect didn't happen since I am still not getting the 
> expected response in my application)....
> 
> To check REMOTE_USER or any other variable, just use a simple CGI 
> script which prints the environment variables.

FYI, Apache httpd logs the value of REMOTE_USER with every line in its access log. No CGI required.

I haven't yet seen that the OP changed the internal id of the attribute to something other than "eppn" or alternatively changed the default attribute-policy.xml: As I've explained in detail what is being sent here is NOT eppn, so the built-in checks from the SP will reject that.
Unless either the id is changed in the attribute-map.xml (and again in the REMOTE_USER precedence list) or the attribute-policy.xml is changed for "eppn" from the ScopiingRule reference to permitAny.

-peter
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=MtgQEAMQGqekjTjiAhkudQ&r=mn6DeBt1nj8Oqx06pdIK0_n5EfK6FeVHgdjBNpchyro&m=Hf3lugoqHOshgE6fjYxswT_vMrNPJxym3pOQknoFq7A&s=97VSMLRnD8anUUvNm6OVoR3cOOufQHTIHvQRHjrhwwk&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net