Unable to get attribute value.

Tomomi test.demo.adobe.2 at gmail.com
Tue Aug 13 20:40:20 EDT 2019 

Hello all,

I use Shib IdP v3 on CentOS 7.5 and Active Directory on Windows Server 2016.

I want to pass the Active Directory attribute(mail,sn,givenName) to SP.
I tried it but it doesn't work.

Debug log is below;

INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
'osabe at addd.daaan.work' succeeded
DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:354] - Profile
Action ValidateUsernamePasswordAgainstLDAP: Adding custom Principal(s)
defined on underlying flow descriptor
DEBUG
[net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] -
Profile Action PopulateSubjectCanonicalizationContext: Installing 2
canonicalization flows into SubjectCanonicalizationContext
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100]
- Profile Action SelectSubjectCanonicalizationFlow: Checking
canonicalization flow c14n/x500 for applicability...
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106]
- Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow
c14n/x500 was not applicable to this request
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100]
- Profile Action SelectSubjectCanonicalizationFlow: Checking
canonicalization flow c14n/simple for applicability...
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] -
Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization
flow c14n/simple
DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] -
Profile Action SimpleSubjectCanonicalization: trimming whitespace of input
string 'osabe at addd.daaan.work'
DEBUG [net.shibboleth.idp.session.impl.DetectIdentitySwitch:148] - Profile
Action DetectIdentitySwitch: No previous session found, nothing to do
DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:138] - Profile
Action FinalizeAuthentication: Canonical principal name was established as
'osabe at addd.daaan.work'
DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:187] - Profile
Action FinalizeAuthentication: Request did not have explicit authentication
requirements, result is accepted
DEBUG
[net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult:221]
- Profile Action UpdateSessionWithAuthenticationResult: Creating new session
for principal osabe at addd.daaan.work
DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:534] -
Created new session
2885082db798eecbf3d026c6144aa338fc52353c2006b1ff015344d7419ba879 for
principal osabe at addd.daaan.work
DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:569] - Saving
AuthenticationResult for flow authn/Password in session
2885082db798eecbf3d026c6144aa338fc52353c2006b1ff015344d7419ba879
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:244]
- Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute
resolution
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:252]
- Attribute Resolver 'ShibbolethAttributeResolver': Attempting to resolve
the following attribute definitions [Email, LastName, ObfuscatedEmail,
FirstName]
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:442]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
for 'Email'
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:398]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector
myLDAP
DEBUG
[net.shibboleth.idp.attribute.resolver.dc.ldap.impl.TemplatedExecutableSearchFilterBuilder:212]
- Template text (uid=$resolutionContext.principal) yields
(uid=osabe at addd.daaan.work)
DEBUG
[net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeValueMappingStrategy:60]
- Results did not contain any entries, nothing to map
DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:136] -
myLDAP no attributes were produced during resolution
DEBUG [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:195] -
Resolver plugin 'myLDAP' produced no value.
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:419]
- Attribute Resolver 'ShibbolethAttributeResolver': Data connector 'myLDAP'
produced no attributes
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:461]
- Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
dependencies for 'Email'
DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:262] -
Attribute Definition 'Email': produced an attribute with no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:339]
- Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition
'Email' produced an attribute with 0 values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:442]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
for 'LastName'
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:461]
- Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
dependencies for 'LastName'
DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:262] -
Attribute Definition 'LastName': produced an attribute with no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:339]
- Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition
'LastName' produced an attribute with 0 values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:442]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
for 'ObfuscatedEmail'
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:461]
- Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
dependencies for 'ObfuscatedEmail'
DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:262] -
Attribute Definition 'ObfuscatedEmail': produced an attribute with no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:339]
- Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition
'ObfuscatedEmail' produced an attribute with 0 values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:442]
- Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
for 'FirstName'
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:461]
- Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
dependencies for 'FirstName'
DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:262] -
Attribute Definition 'FirstName': produced an attribute with no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:339]
- Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition
'FirstName' produced an attribute with 0 values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:262]
- Attribute Resolver 'ShibbolethAttributeResolver': Finalizing resolved
attributes
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:501]
- Attribute Resolver 'ShibbolethAttributeResolver': De-duping (and null
filtering) attribute definition Email result
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:527]
- Attribute Resolver 'ShibbolethAttributeResolver': Removing result of
attribute definition 'Email', contains no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:501]
- Attribute Resolver 'ShibbolethAttributeResolver': De-duping (and null
filtering) attribute definition FirstName result
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:527]
- Attribute Resolver 'ShibbolethAttributeResolver': Removing result of
attribute definition 'FirstName', contains no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:501]
- Attribute Resolver 'ShibbolethAttributeResolver': De-duping (and null
filtering) attribute definition LastName result
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:527]
- Attribute Resolver 'ShibbolethAttributeResolver': Removing result of
attribute definition 'LastName', contains no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:501]
- Attribute Resolver 'ShibbolethAttributeResolver': De-duping (and null
filtering) attribute definition ObfuscatedEmail result
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:527]
- Attribute Resolver 'ShibbolethAttributeResolver': Removing result of
attribute definition 'ObfuscatedEmail', contains no values
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:267]
- Attribute Resolver 'ShibbolethAttributeResolver': Final resolved attribute
collection: []
DEBUG [net.shibboleth.idp.profile.impl.FilterAttributes:325] - Profile
Action FilterAttributes: No attributes to filter
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:126]
- Profile Action PopulateProfileInterceptorContext: Installing flow
intercept/attribute-release into interceptor context
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.FilterFlowsByNonBrowserSupport:52]
- Profile Action FilterFlowsByNonBrowserSupport: Request does not have
non-browser requirement, nothing to do
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:101]
- Profile Action SelectProfileInterceptorFlow: Checking flow
intercept/attribute-release for applicability...
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:84]
- Profile Action SelectProfileInterceptorFlow: Selecting flow
intercept/attribute-release
DEBUG [net.shibboleth.idp.consent.storage.impl.ConsentSerializer:105] -
symbolics '{email=100, homePhone=101, homePostalAddress=102,
mobileNumber=103, pagerNumber=104, commonName=105, surname=106,
locality=107, stateProvince=108, street=109, organizationName=110,
organizationalUnit=111, title=112, postalAddress=113, postalCode=114,
postOfficeBox=115, telephoneNumber=116, givenName=117, initials=118,
departmentNumber=200, displayName=201, employeeNumber=202, employeeType=203,
jpegPhoto=204, preferredLanguage=205, eduPersonAffiliation=300,
eduPersonEntitlement=301, eduPersonNickname=302, eduPersonOrgDN=303,
eduPersonOrgUnitDN=304, eduPersonPrimaryAffiliation=305,
eduPersonPrimaryOrgUnitDN=306, eduPersonPrincipalName=307,
eduPersonScopedAffiliation=308, eduPersonAssurance=309}'
DEBUG [net.shibboleth.idp.consent.flow.impl.InitializeConsentContext:47] -
Profile Action InitializeConsentContext: Created consent context
'ConsentContext{previousConsents={}, chosenConsents={}}'
DEBUG
[net.shibboleth.idp.consent.flow.ar.impl.InitializeAttributeReleaseContext:47]
- Profile Action InitializeAttributeReleaseContext: Created attribute
release context 'AttributeReleaseContext{consentableAttributes={}}'
DEBUG
[net.shibboleth.idp.consent.flow.ar.impl.AbstractAttributeReleaseAction:153]
- Profile Action PopulateAttributeReleaseContext: Found attributeContext
'net.shibboleth.idp.attribute.context.AttributeContext at 3bbf0fa2'
DEBUG
[net.shibboleth.idp.consent.flow.ar.impl.PopulateAttributeReleaseContext:99]
- Profile Action PopulateAttributeReleaseContext: Consentable attributes
'{}'
DEBUG [net.shibboleth.idp.consent.logic.impl.FlowIdLookupFunction:69] -
Current flow id is 'intercept/attribute-release'
DEBUG [net.shibboleth.idp.consent.logic.impl.JoinFunction:81] - Result
'osabe at addd.daaan.work:https://www.okta.com/saml2/service-provider/spimqo4oliLTZM3m60x7'
DEBUG
[net.shibboleth.idp.consent.flow.storage.impl.ReadConsentFromStorage:53] -
Profile Action ReadConsentFromStorage: Read storage record 'null' with
context 'intercept/attribute-release' and key
'osabe at addd.daaan.work:https://www.okta.com/saml2/service-provider/spimqo4oliLTZM3m60x7'
DEBUG
[net.shibboleth.idp.consent.flow.storage.impl.ReadConsentFromStorage:57] -
Profile Action ReadConsentFromStorage: No storage record for context
'intercept/attribute-release' and key
'osabe at addd.daaan.work:https://www.okta.com/saml2/service-provider/spimqo4oliLTZM3m60x7'
DEBUG [net.shibboleth.idp.consent.logic.impl.FlowIdLookupFunction:69] -
Current flow id is 'intercept/attribute-release'
DEBUG
[net.shibboleth.idp.consent.flow.storage.impl.ReadConsentFromStorage:53] -
Profile Action ReadConsentFromStorage: Read storage record 'null' with
context 'intercept/attribute-release' and key 'osabe at addd.daaan.work'
DEBUG
[net.shibboleth.idp.consent.flow.storage.impl.ReadConsentFromStorage:57] -
Profile Action ReadConsentFromStorage: No storage record for context
'intercept/attribute-release' and key 'osabe at addd.daaan.work'
DEBUG [net.shibboleth.idp.consent.flow.impl.PopulateConsentContext:65] -
Profile Action PopulateConsentContext: Populating consents: []
DEBUG [net.shibboleth.idp.consent.logic.impl.IsConsentRequiredPredicate:103]
- Consent is not required, there are no current consents
DEBUG
[net.shibboleth.idp.consent.flow.ar.impl.AbstractAttributeReleaseAction:153]
- Profile Action ReleaseAttributes: Found attributeContext
'net.shibboleth.idp.attribute.context.AttributeContext at 3bbf0fa2'
DEBUG [net.shibboleth.idp.consent.flow.ar.impl.ReleaseAttributes:64] -
Profile Action ReleaseAttributes: Consents '{}'
DEBUG [net.shibboleth.idp.consent.flow.ar.impl.ReleaseAttributes:67] -
Profile Action ReleaseAttributes: Attributes before release '{}'
DEBUG [net.shibboleth.idp.consent.flow.ar.impl.ReleaseAttributes:94] -
Profile Action ReleaseAttributes: Releasing attributes '{}'
DEBUG [net.shibboleth.idp.consent.flow.ar.impl.ReleaseAttributes:96] -
Profile Action ReleaseAttributes: Not releasing attributes '{}'
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.WriteProfileInterceptorResultToStorage:68]
- Profile Action WriteProfileInterceptorResultToStorage: No results
available from interceptor context, nothing to store
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.FilterFlowsByNonBrowserSupport:52]
- Profile Action FilterFlowsByNonBrowserSupport: Request does not have
non-browser requirement, nothing to do
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:65]
- Profile Action SelectProfileInterceptorFlow: Moving completed flow
intercept/attribute-release to completed set, selecting next one
DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:80]
- Profile Action SelectProfileInterceptorFlow: No flows available to choose
from
DEBUG
[net.shibboleth.idp.saml.profile.impl.BaseAddAuthenticationStatementToAssertion:170]
- Profile Action AddAuthnStatementToAssertion: Attempting to add an
AuthenticationStatement to outgoing Assertion
DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAuthnStatementToAssertion:168]
- Profile Action AddAuthnStatementToAssertion: Added AuthenticationStatement
to Assertion _e8490004e1f0171ea0d2086dbf09d9b6
DEBUG
[net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion:229]
- Profile Action AddAttributeStatementToAssertion: Attempting to add an
AttributeStatement to outgoing Assertion
DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:137]
- Profile Action AddAttributeStatementToAssertion: No attributes available
to be encoded, nothing to do
DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:103]
- Profile Action AddAttributeStatementToAssertion: No AttributeStatement was
built, nothing to do
DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:125]
- Configuration specifies the following formats: []
DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:138]
- Configuration did not specify any formats, relying on metadata alone
DEBUG
[net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:197]
- Checking for source attribute Email
INFO
[net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:227]
- Attribute sources [Email] did not produce a usable identifier
DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAssertion:592]
- Found Assertion with AuthnStatement to decorate in outbound Response
DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.DecorateDelegatedAssertion:290]
- Issuance of delegated was not indicated, skipping assertion decoration
DEBUG [PROTOCOL_MESSAGE:131] - Profile Action EncryptAssertions: Response
before assert
.
.
.


attribute resolver is below;

  <AttributeDefinition xsi:type="Simple" id="Email">
        <InputDataConnector ref="myLDAP" attributeNames="mail" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:mail" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.4"
friendlyName="mail" encodeType="false" />
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="LastName">
        <InputDataConnector ref="myLDAP" attributeNames="sn" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:sn" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.4"
friendlyName="sn" encodeType="false" />
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="FirstName">
        <InputDataConnector ref="myLDAP" attributeNames="givenName" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:givenName" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.4"
friendlyName="givenName" encodeType="false" />
    </AttributeDefinition>



Please tell me some solution.

My English isn't so good so feel free to ask me if there is anything
unclear.

Thanks,

Tomomi



--
Sent from: https://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html

More information about the users mailing list