Attribute not in HTTP header
Mathew, Sunil
smathew at hbs.edu
Wed Jan 30 03:57:33 EST 2019
Hi,
I am not able to find the attribute passed from IdP to SP in the header.
Here is the decrypted Assertion:
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_479b2e1a72edeedfc986cf42ebe84bab" IssueInstant="2019-01-30T08:19:17.673Z"
Version="2.0">
<saml2:Issuer>https://sso.stg.org/idp/shibboleth</saml2:Issuer>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="https://sso.stg.org/idp/shibboleth"
SPNameQualifier="https://housing-dev.stg.edu/shibboleth">AAdzZWNyZXQxZIOaDZTOpyWJVeDnpJivX0NB6tPv45Bpwg+M6zMMeH56Ki5K2BueGy5KAnXr
</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="10.229.1.144"
InResponseTo="_a0581a1b2bf7adada2f84ebaf478e4c8" NotOnOrAfter="2019-01-30T08:24:17.693Z"
Recipient="https://housing-dev.stg.edu/Shibboleth.sso/SAML2/POST" />
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2019-01-30T08:19:17.673Z"
NotOnOrAfter="2019-01-30T08:24:17.673Z">
<saml2:AudienceRestriction>
<saml2:Audience>https://housing-dev.stg.edu/shibboleth
</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2019-01-30T07:54:24.779Z"
SessionIndex="_c4e60a2fe554112eca901f6cd66eafad">
<saml2:SubjectLocality Address="10.229.1.144" />
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="SHIB_SESSION_IDENTIFIER"
Name="SHIB_SESSION_IDENTIFIER" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">default
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="SHIB_USER_IDENTIFIER"
Name="SHIB_USER_IDENTIFIER" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">12345
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="SHIB_ACS_INDEX" Name="SHIB_ACS_INDEX"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">1
</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
2019-01-30 03:19:21 DEBUG Shibboleth.SSO.SAML2 [1] [default]: extracting issuer from SAML 2.0 assertion
2019-01-30 03:19:21 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1] [default]: evaluating message flow policy (replay checking on, expiration 60)
2019-01-30 03:19:21 DEBUG XMLTooling.StorageService [1] [default]: inserted record (_479b2e1a72edeedfc986cf42ebe84bab) in context (MessageFlow) with expiration (1548836597)
2019-01-30 03:19:21 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [1] [default]: assertion satisfied bearer confirmation requirements
2019-01-30 03:19:21 DEBUG Shibboleth.SSO.SAML2 [1] [default]: SSO profile processing completed successfully
2019-01-30 03:19:21 DEBUG Shibboleth.SSO.SAML2 [1] [default]: extracting pushed attributes...
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeExtractor.XML [1] [default]: unable to extract attributes, unknown XML object type: saml2p:Response
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeExtractor.XML [1] [default]: skipping unmapped NameID with format (urn:oasis:names:tc:SAML:2.0:nameid-format:transient)
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeExtractor.XML [1] [default]: unable to extract attributes, unknown XML object type: saml2:AuthnStatement
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeDecoder.String [1] [default]: decoding SimpleAttribute (SHIB_SESSION_IDENTIFIER) from SAML 2 Attribute (SHIB_SESSION_IDENTIFIER) with 1 value(s)
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeDecoder.String [1] [default]: decoding SimpleAttribute (SHIB_USER_IDENTIFIER) from SAML 2 Attribute (SHIB_USER_IDENTIFIER) with 1 value(s)
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeDecoder.String [1] [default]: decoding SimpleAttribute (SHIB_ACS_INDEX) from SAML 2 Attribute (SHIB_ACS_INDEX) with 1 value(s)
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeFilter [1] [default]: filtering 3 attribute(s) from (https://sso.stg.org/idp/shibboleth)
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeFilter [1] [default]: applying filtering rule(s) for attribute (SHIB_ACS_INDEX) from (https://sso.stg.org/idp/shibboleth)
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeFilter [1] [default]: applying filtering rule(s) for attribute (SHIB_USER_IDENTIFIER) from (https://sso.stg.org/idp/shibboleth)
2019-01-30 03:19:21 DEBUG Shibboleth.AttributeFilter [1] [default]: applying filtering rule(s) for attribute (SHIB_SESSION_IDENTIFIER) from (https://sso.stg.org/idp/shibboleth)
2019-01-30 03:19:21 DEBUG Shibboleth.SessionCache [1] [default]: creating new session
2019-01-30 03:19:21 DEBUG Shibboleth.SessionCache [1] [default]: storing new session...
2019-01-30 03:19:21 DEBUG XMLTooling.StorageService [1] [default]: inserted record (session) in context (_ca534cc119031801009cb64fde22a4b1) with expiration (1548839961)
2019-01-30 03:19:21 DEBUG XMLTooling.StorageService [1] [default]: inserted record (AAdzZWNyZXQxZIOaDZTOpyWJVeDnpJivX0NB6tPv45Bpwg+M6zMMeH56Ki5K2BueGy5KAnXr/ZpFlV3yPPNpANHiS6CesmHprVTrMxVp5tBOoqGjrdGCL06+VbkBYpyE77U5Md9hY/e8dlKfStZl9Y9sZtU=) in context (NameID) with expiration (1548865161)
2019-01-30 03:19:21 INFO Shibboleth.SessionCache [1] [default]: new session created: ID (_ca534cc119031801009cb64fde22a4b1) IdP (https://sso.stg.org/idp/shibboleth) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (10.229.1.144)
2019-01-30 03:19:21 DEBUG XMLTooling.StorageService [1] [default]: deleted record (586e2d87cef43726744601ed35c33d2602dd6fb40eaaad8cd185980c9837c953) in context (RelayState)
2019-01-30 03:19:21 DEBUG Shibboleth.SSO.SAML2 [1] [default]: ACS returning via redirect to: https://housing-dev.stg.edu/secure/index.asp
2019-01-30 03:19:22 DEBUG Shibboleth.Listener [1] [default]: dispatching message (find::StorageService::SessionCache)
2019-01-30 03:19:22 DEBUG XMLTooling.StorageService [1] [default]: updated expiration of valid records in context (_ca534cc119031801009cb64fde22a4b1) to (1548839962)
But when I print the HTTP Headers I don’t see the attributes I passed to SP (SHIB_SESSION_IDENTIFIER, SHIB_USER_IDENTIFIER, SHIB_ACS_INDEX).
https://housing-dev.stg.edu/secure/index.asp
ALL_HTTP:
HTTP_CACHE_CONTROL:no-cache HTTP_CONNECTION:close HTTP_ACCEPT:text/html, application/xhtml+xml, image/jxr, */* HTTP_ACCEPT_ENCODING:gzip, deflate HTTP_ACCEPT_LANGUAGE:en-US HTTP_COOKIE:ASPSESSIONIDAWBTTCRR=MDANNMKADFPMGHJHMPAKCOCM; ASPSESSIONIDAUCSSCRQ=PMMDHNKAGKDPMNGEKDJCCDIN; ASPSESSIONIDAUARQASR=NFNNBOKAHCFPDDBADMKIFFCM; _shibsession_64656661756c7468747470733a2f2f686f7573696e672d6465762e6862732e6564752f73686962626f6c657468=_ca534cc119031801009cb64fde22a4b1 HTTP_HOST:housing-dev.stg.edu HTTP_REFERER:https://sso.stg.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZJRT4MwFIX%2FCuk7FHBm2AwS3B5cMh0Z6IMvpsBlNIEWe8vUf283ps6XpY8959x7vtwF8r4bWDqaVu7gfQQ0zmffSWSnj5iMWjLFUSCTvAdkpmJ5%2BrhhoeezQSujKtURJ0UEbYSSSyVx7EHnoA%2BigufdJiatMQMySls1opB7t4aD15boQT3SvBVlqTowrYeo6DE6pNk2L4izsrsIyY%2BpfxlWdPSi2XtK76moB2q3aEQHZ%2B8OaqGhMjTPt8RZr2Lyxv3bKOBBGZbNnNf2hU00g5I3s3kEsyqyMsQR1hINlyYmoR%2FcuX7g3viFH7HgjgXzV%2BJk57L3Qta2xXUy5SRC9lAUmTv1eQGNpy5WQJLFkS87DdYXxK%2FH8h%2FMJLkGFX%2BhLujFmGnmwJ5s7nqVqU5UX07adepjqYEbiElAaDJZ%2Fp9E8g0%3D&RelayState=ss%3Amem%3A586e2d87cef43726744601ed35c33d2602dd6fb40eaaad8cd185980c9837c953 HTTP_USER_AGENT:Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko HTTP_DNT:1
ALL_RAW:
Cache-Control: no-cache Connection: close Accept: text/html, application/xhtml+xml, image/jxr, */* Accept-Encoding: gzip, deflate Accept-Language: en-US Cookie: ASPSESSIONIDAWBTTCRR=MDANNMKADFPMGHJHMPAKCOCM; ASPSESSIONIDAUCSSCRQ=PMMDHNKAGKDPMNGEKDJCCDIN; ASPSESSIONIDAUARQASR=NFNNBOKAHCFPDDBADMKIFFCM; _shibsession_64656661756c7468747470733a2f2f686f7573696e672d6465762e6862732e6564752f73686962626f6c657468=_ca534cc119031801009cb64fde22a4b1 Host: housing-dev.stg.edu Referer: https://sso.stg.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZJRT4MwFIX%2FCuk7FHBm2AwS3B5cMh0Z6IMvpsBlNIEWe8vUf283ps6XpY8959x7vtwF8r4bWDqaVu7gfQQ0zmffSWSnj5iMWjLFUSCTvAdkpmJ5%2BrhhoeezQSujKtURJ0UEbYSSSyVx7EHnoA%2BigufdJiatMQMySls1opB7t4aD15boQT3SvBVlqTowrYeo6DE6pNk2L4izsrsIyY%2BpfxlWdPSi2XtK76moB2q3aEQHZ%2B8OaqGhMjTPt8RZr2Lyxv3bKOBBGZbNnNf2hU00g5I3s3kEsyqyMsQR1hINlyYmoR%2FcuX7g3viFH7HgjgXzV%2BJk57L3Qta2xXUy5SRC9lAUmTv1eQGNpy5WQJLFkS87DdYXxK%2FH8h%2FMJLkGFX%2BhLujFmGnmwJ5s7nqVqU5UX07adepjqYEbiElAaDJZ%2Fp9E8g0%3D&RelayState=ss%3Amem%3A586e2d87cef43726744601ed35c33d2602dd6fb40eaaad8cd185980c9837c953 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko dnt: 1
Here is the attribute-map.xml:
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<Attribute name="SHIB_SESSION_IDENTIFIER" id="SHIB_SESSION_IDENTIFIER"/>
<Attribute name="SHIB_USER_IDENTIFIER" id="SHIB_USER_IDENTIFIER"/>
<Attribute name="SHIB_ACS_INDEX" id="SHIB_ACS_INDEX"/>
</Attributes>
Regards,
Sunil
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190130/2b1cf326/attachment.html>
More information about the users
mailing list