[EXTERNAL] [Suspected SPAM] Re: Missing Shibboleth attributes in $_Server

[MARTINEZ, ARIEL]

I allowed a new shib.log to be created with debug logging but there is some information contained in it that I would not want to make public. It is pulling attributes from my LDAP, things like group membership, mail and eppn as defined in my ADFS Relying Party Trust. Here is a snip of the log after the attributes:

The only error I can see is AttributeExtractor "unable to extract attributes" not sure if that would be an issue.

DEBUG Shibboleth.SSO.SAML2 [3] [default]: SSO profile processing completed successfully
2020-09-21 16:42:48 DEBUG Shibboleth.SSO.SAML2 [3] [default]: extracting pushed attributes...
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeExtractor.XML [3] [default]: unable to extract attributes, unknown XML object type: samlp:Response
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeExtractor.XML [3] [default]: unable to extract attributes, unknown XML object type: {urn:oasis:names:tc:SAML:2.0:assertion}AuthnStatement
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeDecoder.Scoped [3] [default]: decoding ScopedAttribute (SHIB_EPPN) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)
2020-09-21 16:42:48 INFO Shibboleth.AttributeExtractor.XML [3] [default]: skipping SAML 2.0 Attribute with Name: http://schemas.xmlsoap.org/claims/Group, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeDecoder.String [3] [default]: decoding SimpleAttribute (mail) from SAML 2 Attribute (urn:oid:0.9.2342.19200300.100.1.3) with 1 value(s)
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeDecoder.String [3] [default]: decoding SimpleAttribute (displayName) from SAML 2 Attribute (urn:oid:2.16.840.1.113730.3.1.241) with 1 value(s)
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeFilter [3] [default]: filtering 3 attribute(s) from (http://login.hostos.cuny.edu/adfs/services/trust)
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeFilter [3] [default]: applying filtering rule(s) for attribute (displayName) from (http://login.hostos.cuny.edu/adfs/services/trust)
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeFilter [3] [default]: applying filtering rule(s) for attribute (mail) from (http://login.hostos.cuny.edu/adfs/services/trust)
2020-09-21 16:42:48 DEBUG Shibboleth.AttributeFilter [3] [default]: applying filtering rule(s) for attribute (SHIB_EPPN) from (http://login.hostos.cuny.edu/adfs/services/trust)
2020-09-21 16:42:48 DEBUG Shibboleth.SessionCache [3] [default]: creating new session
2020-09-21 16:42:48 DEBUG Shibboleth.SessionCache [3] [default]: storing new session...
2020-09-21 16:42:48 DEBUG XMLTooling.StorageService [3] [default]: inserted record (session) in context (_377d8401f5899b1d86b1304b113686e6) with expiration (1600724568)
2020-09-21 16:42:48 INFO Shibboleth.SessionCache [3] [default]: new session created: ID (_377d8401f5899b1d86b1304b113686e6) IdP (http://login.hostos.cuny.edu/adfs/services/trust) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (10.32.14.218)
2020-09-21 16:42:48 DEBUG XMLTooling.StorageService [3] [default]: deleted record (16ca36f4b5803deaca99d5ed7ea927f0356a2b64adb9dff34d843c3f55683e3c) in context (RelayState)
2020-09-21 16:42:48 DEBUG Shibboleth.SSO.SAML2 [3] [default]: ACS returning via redirect to: https://vcl.hostos.cuny.edu/secure

Thanks


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober
Sent: Monday, September 21, 2020 9:23 AM
To: users at shibboleth.net
Subject: [EXTERNAL] [Suspected SPAM] Re: Missing Shibboleth attributes in $_Server
Importance: Low

WARNING: This email originated outside the Hostos campus. Do not click links or open attachments unless you recognize the sender and know the content is safe. Never provide login credentials, financial or sensitive details in response to an email or by clicking on a link. Report suspicious emails to: reportspam at hostos.cuny.edu


* MARTINEZ, ARIEL <AMARTINEZ at hostos.cuny.edu> [2020-09-20 18:28]:
> > E.g.: what happens if you first establish a session by going to 
> > /Shibboleth.sso/Login and then right after that access /secure ?
> > (or both in one go via /Shibboleth.sso/Login?target=/secure )
>
> In both cases I get the error "Unauthorized This server could not 
> verify that you are authorized to access the document requested. 
> Either you supplied the wrong credentials (e.g., bad password), or 
> your browser doesn't understand how to supply the credentials 
> required."

Doesn't make sense to me with an established session for the whole vhost and only "require shib-session" for authz at /secure.

Change the log level for the native log to DEBUG and restart both parts (shibd, httpd) before retrying. That should at least give the reason why the session can't be seen.

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net