Missing Attributes

[Thermal Reboot]

Thanks for all your help, I finally figured out what was going on.

My definition for eduPersonScopedAffiliation is below
    <resolver:AttributeDefinition xsi:type="ad:Scoped"
id="eduPersonScopedAffiliation"
scope="%{idp.scope}" sourceAttributeID="eduPersonAffiliation">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString"
name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
friendlyName="eduPersonScopedAffiliation"
encodeType="false" />
    </resolver:AttributeDefinition>

While I was trying to understand the function of scope I was completely
overlooking that eduPersonScopedAffiliation was defined by
eduPersonAffiliation.  I was confusing eduPersonAffiliation which we don't
populate with eduPersonPrimayAffiliation which we do.  Once I realized that
it was trying to combine my scope, which does exist, with
eduPersonAffiliation which does not, it was creating a NULL value.

I changed the above definition to make the
sourceAttributeID="eduPersonPrimaryAffiliation" and now it works.

Thanks
-Bob

On Thu, Jun 21, 2018 at 10:29 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> >     I guess I'm confused on the idea of scope, I can't find a clear
> definition of it,
> > all the docs I read assume you know what that is.
>
> Basically, if I can assert your users' identifiers to a service...there's
> a potential problem.
>
> A scope is a qualifier for an identifier that makes it unique only within
> that namespace and is conventionally part of the identifier value, usually
> with an email-like/DNS-like syntax, but not exclusively.
>
> Federation requires namespace awareness of identifiers, and scoping is a
> way of doing that that can be semi-automated by third party federations if
> the software supports the concept and if they publish metadata that can
> authorize an IdP to assert data within particular scopes, which is what the
> Shibboleth software (by way of me) invented and developed a metadata
> extension to capture. It is supported essentially nowhere other than higher
> ed federation and the software we build.
>
> A Shibboleth SP defaults to processing specifically scoped attributes
> defined in higher ed in this way. It does not do this for attributes other
> than those defined in this way.
>
> If you're not operating in the context of a federation like InCommon or
> others, then none of this generally applies and you probably have to deal
> with the problem in other ways, are using email addresses as an identifier,
> or have gaping security holes in your services, or all three.
>
> > Is scope something I'm
> > matching on?
>
> An SP aware of scoped attributes matches on it for policy/filtering.
>
> >  Would I put testshib.org <http://testshib.org>  there if I wanted
> > that attribute to be delivered to testshib.org <http://testshib.org> ?
>
> That would be backwards, as I hope the explanation suggests, testshib is
> the SP so it consumes the data.
>
> > Or is it
> > something else?  In my definition I have scope="%{idp.scope}", is this a
> wild card?
>
> That's a property replacement expression.
>
> https://wiki.shibboleth.net/confluence/display/IDP30/SpringConfiguration
>
> The IdP property for the scope is something that doesn't have a good
> natural home in the documentation due it's somewhat odd heritage. It's sort
> of an attribute resolver thing, but I don't recall where it's actually
> documented.
>
> -- Scott
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180621/a847f31e/attachment.html>