Unable to pick up incoming attributes from the assertion

[Nate Klingenstein]

Amit,

While you are free to define new nameFormats in namespaces you control, under no circumstances would urn:oasis:names:tc:SAML:2.0:assertion be an acceptable name format for an attribute, since it's already used by OASIS and SAML for identifying assertion elements.  it could be throwing off the parsing of the attribute.

Your configuration looks fine to me, but I don't think that nameFormat will ever fly.  I would consider this an IdP bug and ask them to correct that to "basic" or, if possible, a URI that matches the LDAP OID.

https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Amit Dongaonkar
Sent: Friday, July 16 2021, 4:53 pm
To: Shib Users
Subject: Unable to pick up incoming attributes from the assertion

Hello group,

I am trying to integrate a new IdP and I see the following pattern in the attribute statement of the incoming assertion:

<saml:Attribute Name="uid"
                            NameFormat="urn:oasis:names:tc:SAML:2.0:assertion"
                            >
                <saml:AttributeValue xsi:type="xs:string">sankars</saml:AttributeValue>
            </saml:Attribute>

My attribute-map.xml has the following corresponding configuration :

 <Attribute name="uid" id="USER_LOGIN_ID" nameFormat="urn:oasis:names:tc:SAML:2.0:assertion"/>

I am expecting the SP to capture this attribute, however, I see the following the shibd.log file

 INFO Shibboleth.AttributeExtractor.XML [1] [default]: skipping SAML 2.0 Attribute with Name: uid, Format:urn:oasis:names:tc:SAML:2.0:assertion

Is there some other parameter that needs to be set up for the above to work?

Thanks in advance.

Thanks and Regards,

Amit Dongaonkar

--

For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net