subject-id as a computedID help

[Satya Mohapatra]

Hi Alan, Scott, 

Thanks for both of your responses which indeed helped me debug the problem.  It turned out at the SP attribute-policy.xml the scope filtering was the cause. 

The relevant section of attribute-policy.xml of the SP.


<afp:PermitValueRule id="ScopingRules" xsi:type="AND">
        <Rule xsi:type="NOT">
            <Rule xsi:type="AttributeValueRegex" regex="@"/>
	</Rule>
        <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope"/>
    </afp:PermitValueRule>

 <afp:AttributeRule attributeID="subject-id"> -->
        <!--     <afp:PermitValueRuleReference ref="ScopingRules"/> —>
  <!-- </afp:AttributeRule> -->

When I comment out to drop scope checking rule for "subject-id” then I get the attribute all right. 

Please note that the “test.org” in my earlier email was just a mistaken entry in the email. When I actually use the correct scope string or even %{idp.scope}, the above attribute-policy at the SP is dropping the attribute. 

<resolver:AttributeDefinition id="subject-id" xsi:type="ad:Scoped" scope=“%{idp.scope}" sourceAttributeID="computedID">
     <resolver:Dependency ref="computedID" />
     <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oasis:names:tc:SAML:attribute:subject-id" friendlyName="subject-id" encodeType="false" />
   </resolver:AttributeDefinition>


Thanks, 


---
Satya Mohapatra | ସତ୍ୟ ମହାପାତ୍ର |  सत्य महापात्र |  ستیا موہپترا


> On Jan 16, 2020, at 9:09 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 1/15/20, 11:14 PM, "users on behalf of Satya Mohapatra" <users-bounces at shibboleth.net on behalf of patra at mit.edu> wrote:
>> Any suggestion what I could be doing wrong ?
> 
> Probably not including test.org in a Scope extension in the IdP's metadata.
> 
> —
> Scott
> 

> On Jan 16, 2020, at 5:24 AM, Alan Buxey <alan.buxey at myunidays.com> wrote:
> hi,
> 
>> WARN Shibboleth.AttributeFilter [1] [default]: removed value at position (0) of attribute (subject-id) from (https://login-test.ligo.org/idp/shibboleth)
>> WARN Shibboleth.AttributeFilter [1] [default]: no values left, removing attribute (subject-id) from (https://login-test.ligo.org/idp/shibboleth)
> 
> is that ALL its saying? no mention above that top line about applying
> filtering rule?
> 
>> The attribute map at the SP has the following:
>> <Attribute name="urn:oasis:names:tc:SAML:attribute:subject-id" id="subject-id”/>
> 
> 
> is that all?  no attribute decoder specified?
> 
> 
> I would run a login session with SAMLTracer plugin being used so you
> can see what messages and values are being sent through (format etc).
> 
> alan





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200116/f15874cc/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 1885 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20200116/f15874cc/attachment.p7s>