Help! One of our applications is not receiving attributes

[Lipscomb, Gary]

Hi Melvin

Have you tried

/opt/shibboleth-idp/bin/aacli.sh --saml2 -n melvin.lasky -r https://idapproval-test.wc.manhattan.edu/

To see what is released

A saml trace in the browser to see what the real entityID is
Check the metadata as well for entityID
Xmllint on your  attribute-filter.xml and metadata files to check for syntax errors

Regards

Gary

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Melvin Lasky
Sent: Friday, 9 August 2019 08:53
To: Shib Users <users at shibboleth.net>
Subject: Help! One of our applications is not receiving attributes

We have many websites running on our Shibboleth instance. We are also part of the incommon federation. Everything is working great. However, one of in-house developed apps is not receiving attributes. I don’t see SHIB sending them.

Any help would be greatly appreciated.

We have a regex, but in order to rule out any weirdness with the regex, I have hardcoded the value in the attribute filter

<AttributeFilterPolicy id="releaseForIDApprovalTEST" >
  <PolicyRequirementRule xsi:type="Requester" value="https://idapproval-test.wc.manhattan.edu/" />
        <AttributeRule attributeID="eduPersonPrincipalName" permitAny="true"  />
        <AttributeRule attributeID="eduPersonScopedAffiliation" permitAny="true" />
        <AttributeRule attributeID="employeeType" permitAny="true" />
        <AttributeRule attributeID="surname" permitAny="true" />
        <AttributeRule attributeID="givenName" permitAny="true" />
        <AttributeRule attributeID="mail" permitAny="true" />
        <AttributeRule attributeID="employeeNumber" permitAny="true" />
        <AttributeRule attributeID="uid" permitAny="true" />
</AttributeFilterPolicy>

But, I’m not seeing anything. Other attribute filters work no problem, etc etc.

Here’s our log

shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2019-08-08 22:48:27,844 - INFO [Shibboleth-Audit.SSO:275] - 20190808T224827Z|||https://idapproval-test.wc.manhattan.edu/|https://www.apereo.org/cas/protocol/login||||melvin.lasky|||melvin.lasky|ST-AADXGZLDOJSXIMNMWOQQ6RCGW5R4WWD3EMQR44MVQDG5OMN7KVZZKFIRWH6SG2TPNMEQL35KYJW2JMWCZMKSN32PFHP5JMZDLDQ2NQUBWMNN4ML732H64ZA2H27M5KPD5SML3CMLCI2JGYYKPNH47WKRSHEV6ISD2DT2LWF2I2JCIJWMGLPJAK6DP7CKDZA2WAAWQFS4O6SA6MC2WOYV65FOYW2TG6JSJJKG2VN5L3KS3ZYJ6J5QTZ7YWWNFL6W67TRO7CWUAJXMZMROCTHZGGNEINYYJLAX5OQVMTDGBUZT2MZLSX2K3BUMVFBVLTZKZKG76AMBFHKRB7W55C4ZRAFNMZKK7DGV5FKQRMPBALK3M2XXK4UISJXZ2ED4WUDZIXKO6---|
shib-idp;idp-process.log;dev;nothing; - [149.61.2.59]2019-08-08 22:48:27,908 - INFO [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:117] - Successfully validated ST-AADXGZLDOJSXIMNMWOQQ6RCGW5R4WWD3EMQR44MVQDG5OMN7KVZZKFIRWH6SG2TPNMEQL35KYJW2JMWCZMKSN32PFHP5JMZDLDQ2NQUBWMNN4ML732H64ZA2H27M5KPD5SML3CMLCI2JGYYKPNH47WKRSHEV6ISD2DT2LWF2I2JCIJWMGLPJAK6DP7CKDZA2WAAWQFS4O6SA6MC2WOYV65FOYW2TG6JSJJKG2VN5L3KS3ZYJ6J5QTZ7YWWNFL6W67TRO7CWUAJXMZMROCTHZGGNEINYYJLAX5OQVMTDGBUZT2MZLSX2K3BUMVFBVLTZKZKG76AMBFHKRB7W55C4ZRAFNMZKK7DGV5FKQRMPBALK3M2XXK4UISJXZ2ED4WUDZIXKO6--- for https://idapproval-test.wc.manhattan.edu/
shib-idp;idp-process.log;dev;nothing; - [35.194.79.151]2019-08-08 22:48:27,916 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: TicketNotFromRenew
shib-idp;idp-warn.log;dev;nothing;2019-08-08 22:48:27,916 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: TicketNotFromRenew
shib-idp;idp-audit.log;dev;nothing;[35.194.79.151] - 20190808T224827Z|||https://idapproval-test.wc.manhattan.edu/|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-AADXGZLDOJSXIMNMWOQQ6RCGW5R4WWD3EMQR44MVQDG5OMN7KVZZKFIRWH6SG2TPNMEQL35KYJW2JMWCZMKSN32PFHP5JMZDLDQ2NQUBWMNN4ML732H64ZA2H27M5KPD5SML3CMLCI2JGYYKPNH47WKRSHEV6ISD2DT2LWF2I2JCIJWMGLPJAK6DP7CKDZA2WAAWQFS4O6SA6MC2WOYV65FOYW2TG6JSJJKG2VN5L3KS3ZYJ6J5QTZ7YWWNFL6W67TRO7CWUAJXMZMROCTHZGGNEINYYJLAX5OQVMTDGBUZT2MZLSX2K3BUMVFBVLTZKZKG76AMBFHKRB7W55C4ZRAFNMZKK7DGV5FKQRMPBALK3M2XXK4UISJXZ2ED4WUDZIXKO6---|
shib-idp;idp-process.log;dev;nothing; - [35.194.79.151]2019-08-08 22:48:27,917 - INFO [Shibboleth-Audit.SSO:275] - 20190808T224827Z|||https://idapproval-test.wc.manhattan.edu/|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-AADXGZLDOJSXIMNMWOQQ6RCGW5R4WWD3EMQR44MVQDG5OMN7KVZZKFIRWH6SG2TPNMEQL35KYJW2JMWCZMKSN32PFHP5JMZDLDQ2NQUBWMNN4ML732H64ZA2H27M5KPD5SML3CMLCI2JGYYKPNH47WKRSHEV6ISD2DT2LWF2I2JCIJWMGLPJAK6DP7CKDZA2WAAWQFS4O6SA6MC2WOYV65FOYW2TG6JSJJKG2VN5L3KS3ZYJ6J5QTZ7YWWNFL6W67TRO7CWUAJXMZMROCTHZGGNEINYYJLAX5OQVMTDGBUZT2MZLSX2K3BUMVFBVLTZKZKG76AMBFHKRB7W55C4ZRAFNMZKK7DGV5FKQRMPBALK3M2XXK4UISJXZ2ED4WUDZIXKO6---|
shib-idp;idp-audit.log;dev;nothing;[149.61.234.126] - 20190808T224832Z|||https://lms.manhattan.edu/login/|https://www.apereo.org/cas/protocol/login|||||||||


If you need any other information, just let me know.

Thanks for all your help!

Hopefully we can get to the bottom of this!

Have a great day / night!

Melvin Lasky
Associate Director of Enterprise Architecture





Riverdale, NY 10471
Phone: 718-862-7410
melvin.lasky at manhattan.edu
www.manhattan.edu