Missing Attributes
Thermal Reboot
thermalreboot at gmail.com
Thu Jun 21 10:02:04 EDT 2018
Hi David,
I guess I'm confused on the idea of scope, I can't find a clear
definition of it, all the docs I read assume you know what that is. Is
scope something I'm matching on? Would I put testshib.org there if I
wanted that attribute to be delivered to testshib.org? Or is it something
else? In my definition I have scope="%{idp.scope}", is this a wild card?
or a place holder that I need to replace?
Thanks
-Bob
On Wed, Jun 20, 2018 at 2:16 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
> Sorry I haven't been much help.
>
> The scope in my resolver definitions is alaska.edu because that's the
> scope for my IdP. Yours will of course be whatever scope for which your IdP
> is authoritative.
>
> David Bantz
>
> On Wed, Jun 20, 2018 at 9:02 AM, Thermal Reboot <thermalreboot at gmail.com>
> wrote:
>
>> Hi David,
>>
>> I'm still trying to make this work but no luck so far, when I copied
>> and pasted your definition it broke my IDP. Here are my definitions:
>>
>> <resolver:AttributeDefinition xsi:type="ad:Scoped"
>> id="eduPersonScopedAffiliation" scope="%{idp.scope}"
>> sourceAttributeID="eduPersonAffiliation">
>> <resolver:Dependency ref="myLDAP" />
>> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString"
>> name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
>> encodeType="false" />
>> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString"
>> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation"
>> encodeType="false" />
>> </resolver:AttributeDefinition>
>>
>> You mentioned my eduPersonAffiliation definition so here it is:
>>
>> <resolver:AttributeDefinition xsi:type="ad:Simple"
>> id="eduPersonAffiliation" sourceAttributeID="eduPersonAffiliation">
>> <resolver:Dependency ref="myLDAP" />
>> <resolver:AttributeEncoder xsi:type="enc:SAML1String"
>> name="urn:mace:dir:attribute-def:eduPersonAffiliation"
>> encodeType="false" />
>> <resolver:AttributeEncoder xsi:type="enc:SAML2String"
>> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" friendlyName="eduPersonAffiliation"
>> encodeType="false" />
>> </resolver:AttributeDefinition>
>>
>> I tried testing this against sp.testshib.org and even changed the scope
>> of eduPersonScopedAffiliation to scope="testshib.org" based on your
>> example, but I didn't see it release. I'm thinking that there's something
>> I don't understand about the idea of a scope.
>>
>> Thanks
>> -Bob
>>
>> On Fri, Jun 15, 2018 at 11:04 AM, IAM David Bantz <dabantz at alaska.edu>
>> wrote:
>>
>>> I think you need the explicit Dependency on the source attribute:
>>>
>>> Assuming eduPersonAffiliaiton is properly defined elsewhere in
>>> attribute-resolver.
>>>
>>> <AttributeDefinition id="eduPersonScopedAffiliation" xsi:type=
>>> "Scoped"
>>>
>>> scope="alaska.edu" sourceAttributeID="eduPersonAffiliation">
>>>
>>> *<Dependency ref="eduPersonAffiliation" />*
>>>
>>>
>>> <AttributeEncoder xsi:type="SAML1ScopedString"
>>>
>>> name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
>>> />
>>>
>>>
>>> <AttributeEncoder xsi:type="SAML2ScopedString"
>>>
>>> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName=
>>> "eduPersonScopedAffiliation" />
>>>
>>> </AttributeDefinition>
>>>
>>> Sorry I muddied the water with mention of "transient" - I should have
>>> written "targeted":
>>> The idea of targeted id is that to be a different value for every SP,
>>> preserving some element of privacy because it doesn't support directly
>>> correlating an individual user's activity between SPs.
>>> So a properly defined targeted id is not going to be a static value from
>>> your attribute store, it's going to be ginned up from some source value but
>>> deliberately have a different value for each different SP.
>>>
>>> Hope this helps.
>>>
>>> David Bantz
>>>
>>> On Fri, Jun 15, 2018 at 6:20 AM, Thermal Reboot <thermalreboot at gmail.com
>>> > wrote:
>>>
>>>> I'm hardly an expert and I'm desperately trying to get my head around
>>>> these concepts, I wish there were an Oreilly book on Shibboleth as I find
>>>> the website very dry and assumes you know what you want to do.
>>>>
>>>> Here is what I have in attribute-resolver.xml, I assume that's what you
>>>> want.
>>>>
>>>> <resolver:AttributeDefinition xsi:type="ad:Scoped"
>>>> id="eduPersonScopedAffiliation" scope="%{idp.scope}"
>>>> sourceAttributeID="eduPersonAffiliation">
>>>> <resolver:Dependency ref="myLDAP" />
>>>> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString"
>>>> name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
>>>> encodeType="false" />
>>>> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString"
>>>> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation"
>>>> encodeType="false" />
>>>> </resolver:AttributeDefinition>
>>>>
>>>> As for the eduPersonTargetedID sending a transient, it's a mystery to
>>>> me.
>>>>
>>>> Here's my attribute-resolver.xml entry for that:
>>>>
>>>> <resolver:AttributeDefinition xsi:type="ad:SAML2NameID"
>>>> id="eduPersonTargetedID"
>>>> nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>>>> sourceAttributeID="computedID">
>>>> <resolver:Dependency ref="computedID" />
>>>> <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"
>>>> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
>>>> <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"
>>>> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID"
>>>> />
>>>> </resolver:AttributeDefinition>
>>>>
>>>>
>>>> Thanks
>>>> -Bob
>>>>
>>>> On Thu, Jun 14, 2018 at 6:22 PM, IAM David Bantz <dabantz at alaska.edu>
>>>> wrote:
>>>>
>>>>> An attribute with null value - as explicitly indicated in your log
>>>>> snippet - will not be sent.
>>>>>
>>>>> You don't include the attribute resolver definition but the earlier
>>>>> log entry indicates an LDAP value of "Staff" which is not scoped.
>>>>>
>>>>> I'm not at all clear what you're trying to do in attempting to release
>>>>> a "transient" identifier that has the persistent (i.e., non-transient)
>>>>> value of a directory attribute - isn't that a category mis-match?
>>>>>
>>>>> David Bantz
>>>>>
>>>>> On Thu, Jun 14, 2018 at 11:48 AM, Thermal Reboot <
>>>>> thermalreboot at gmail.com> wrote:
>>>>>
>>>>>> Hello,
>>>>>>
>>>>>> I have an SP that requires eduPersonScopedAffiliation and
>>>>>> eduPersonTargetedID. To test this I setup my attribute-filter.xml files to
>>>>>> deliver these two attributes to sp.testshib.org, but neither of them
>>>>>> are being delivered.
>>>>>>
>>>>>> I've verified that both attributes are populated in AD and can
>>>>>> see that they're being delivered by LDAP:
>>>>>>
>>>>>> 2018-06-14 15:00:50,193 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.AbstractDataConnector:143] - Data Connector 'myLDAP':
>>>>>> Attribute 'eduPersonScopedAffiliation': Values
>>>>>> '[StringAttributeValue{value=Staff}]'
>>>>>>
>>>>>> 2018-06-14 15:00:50,194 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.AbstractDataConnector:143] - Data Connector 'myLDAP':
>>>>>> Attribute 'eduPersonTargetedID': Values '[StringAttributeValue{value=l
>>>>>> amother}]'
>>>>>>
>>>>>> Yet I also see this:
>>>>>>
>>>>>> 2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:372] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Resolving dependencies for
>>>>>> 'eduPersonScopedAffiliation'
>>>>>> 2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:388] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Finished resolving dependencies for
>>>>>> 'eduPersonScopedAffiliation'
>>>>>> 2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.AbstractAttributeDefinition:245] - Attribute Definition
>>>>>> 'eduPersonScopedAffiliation': produced an attribute with no values
>>>>>> 2018-06-14 10:21:50,313 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:272] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Attribute definition
>>>>>> 'eduPersonScopedAffiliation' produced an attribute with 0 values
>>>>>> 2018-06-14 10:21:50,353 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:428] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Removing result of attribute definition
>>>>>> 'eduPersonScopedAffiliation', contains no values
>>>>>>
>>>>>>
>>>>>> And
>>>>>>
>>>>>> 2018-06-14 15:00:50,261 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:372] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Resolving dependencies for
>>>>>> 'eduPersonTargetedID'
>>>>>> 2018-06-14 15:00:50,264 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:388] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Finished resolving dependencies for
>>>>>> 'eduPersonTargetedID'
>>>>>> 2018-06-14 15:00:50,276 - DEBUG [net.shibboleth.idp.saml.attri
>>>>>> bute.resolver.impl.SAML2NameIDAttributeDefinition:153] - Attribute
>>>>>> Definition 'eduPersonTargetedID': building a SAML2 NameID with value of
>>>>>> 'XgQzYSIOcCKtS8gcaeSXYCyfsfE='
>>>>>> 2018-06-14 15:00:50,276 - DEBUG [net.shibboleth.idp.saml.attri
>>>>>> bute.resolver.impl.SAML2NameIDAttributeDefinition:164] - Attribute
>>>>>> Definition 'eduPersonTargetedID': Format set to
>>>>>> 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
>>>>>> 2018-06-14 15:00:50,277 - DEBUG [net.shibboleth.idp.saml.attri
>>>>>> bute.resolver.impl.SAML2NameIDAttributeDefinition:172] - Attribute
>>>>>> Definition 'eduPersonTargetedID': NameQualifier set to '
>>>>>> https://testshib.umassmed.edu/idp/shibboleth'
>>>>>> 2018-06-14 15:00:50,277 - DEBUG [net.shibboleth.idp.saml.attri
>>>>>> bute.resolver.impl.SAML2NameIDAttributeDefinition:182] - Attribute
>>>>>> Definition 'eduPersonTargetedID': SPNameQualifier set to '
>>>>>> https://sp.testshib.org/shibboleth-sp'
>>>>>> 2018-06-14 15:00:50,278 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.AbstractAttributeDefinition:247] - Attribute Definition
>>>>>> 'eduPersonTargetedID': produced an attribute with the following values
>>>>>> [XMLObjectAttributeValue{value=org.opensaml.saml.saml2.core.
>>>>>> impl.NameIDImpl at d7124d8}]
>>>>>> 2018-06-14 15:00:50,278 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:272] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Attribute definition 'eduPersonTargetedID'
>>>>>> produced an attribute with 1 values
>>>>>> 2018-06-14 15:00:50,366 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:434] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': De-duping attribute definition
>>>>>> eduPersonTargetedID result
>>>>>> 2018-06-14 15:00:50,366 - DEBUG [net.shibboleth.idp.attribute.
>>>>>> resolver.impl.AttributeResolverImpl:446] - Attribute Resolver
>>>>>> 'ShibbolethAttributeResolver': Attribute 'eduPersonTargetedID' has 1 values
>>>>>> after post-processing
>>>>>>
>>>>>>
>>>>>> My decrypted Assertion at sp.testshib.org looks like:
>>>>>>
>>>>>> 2018-06-14 15:41:49 DEBUG Shibboleth.SSO.SAML2 [76]: decrypted Assertion: <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_f8ee0b26b509a4840675be141cefd1f0" IssueInstant="2018-06-14T19:41:48.238Z" Version="2.0"><saml2:Issuer>https://testshib.umassmed.edu/idp/shibboleth</saml2:Issuer><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://testshib.umassmed.edu/idp/shibboleth" SPNameQualifier="https://sp.testshib.org/shibboleth-sp" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">AAlzZWNyZXQ4ODZCiDJKa7lVg5ZzS4KC9fJRKm/5M3zTvK1kZ6/O2iqrEfMDjzNgTuD0OlQEQgXQdq/CSEVuJmHIAy7+eFJ4bgYz80Znlp0oMPad2nyuLIxI3xqZOIP31dMgqHCaWmYzNvCpG4LL0W5InfUv</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="146.189.148.19" InResponseTo="_d3f4f0823fe28c735d62a9ed6d717552" NotOnOrAfter="2018-06-14T19:46:48.364Z" Recipient="https://sp.testshib.org/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2018-06-14T19:41:48.238Z" NotOnOrAfter="2018-06-14T19:46:48.238Z"><saml2:AudienceRestriction><saml2:Audience>https://sp.testshib.org/shibboleth-sp</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2018-06-14T19:41:39.175Z" SessionIndex="_881534154dad964ab5923b2ec0e9e355"><saml2:SubjectLocality Address="146.189.148.19"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>LamotheR</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="eduPersonPrimaryAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Staff</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Robert.Lamothe at umassmed.edu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://testshib.umassmed.edu/idp/shibboleth" SPNameQualifier="https://sp.testshib.org/shibboleth-sp">XgQzYSIOcCKtS8gcaeSXYCyfsfE=</saml2:NameID></saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="displayName" Name="urn:oid:2.16.840.1.113730.3.1.241" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Lamothe, Robert L</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Lamothe</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Robert</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>lamother at umassmed.edu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="title" Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Sr Eng, Sys Admin</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement>
>>>>>> </saml2:AttributeStatement></saml2:Assertion>
>>>>>>
>>>>>> In the Assertion I see eduPersonTargetedID which looks like it's being set to NameID instead of the AD value,
>>>>>>
>>>>>> yet I don't see eduPersonScopedAffiliation.
>>>>>>
>>>>>> Am I miss understanding something? Is my config messed up?
>>>>>>
>>>>>> Thanks
>>>>>>
>>>>>> -Bob
>>>>>>
>>>>>>
>>>>>> --
>>>>>> For Consortium Member technical support, see
>>>>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>>>>> To unsubscribe from this list send an email to
>>>>>> users-unsubscribe at shibboleth.net
>>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> For Consortium Member technical support, see
>>>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>>>> To unsubscribe from this list send an email to
>>>>> users-unsubscribe at shibboleth.net
>>>>>
>>>>
>>>>
>>>> --
>>>> For Consortium Member technical support, see
>>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>>> To unsubscribe from this list send an email to
>>>> users-unsubscribe at shibboleth.net
>>>>
>>>
>>>
>>> --
>>> For Consortium Member technical support, see
>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180621/4d7cdeb3/attachment.html>
More information about the users
mailing list