Shibbolet SP: empty attributes

[Lorenzo Milesi]

Hi. 
I've configured an IdP with SimpleSamlPHP with auth against Active Directory, tested with Nextcloud as SP and authenticates correctly. 

Now I'm trying to add Apache2 and mod_shib but I get empty attributes after authentication.
In SSP when I test auth I can see all the returned user information from the IdP, and it has all the AD LDAP entries. Username is sAMAccountName.

When visiting /Shibboleth.sso/Session on the SP:

Miscellaneous
Session Expiration (barring inactivity): 461 minute(s)
Client Address: 84.1.2.90
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: https://auth.domain.com/sso/saml2/idp/metadata.php
Authentication Time: 2021-07-19T15:39:50Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributes


As attribute-map.xml I'm using [1] with added
    <Attribute name="urn:mace:umsystem.edu:attribute-def:samAccountName" id="samaccountname">
        <AttributeDecoder xsi:type="StringAttributeDecoder"   caseSensitive="false"/>
    </Attribute>

In shibboleth2.xml I added:
    <ApplicationDefaults entityID="https://test2021.domain.com/shibboleth"
        REMOTE_USER="sAMAccountName uid eseppn subject-id pairwise-id persistent-id"
        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">


I tried several guides but I'm unable to move forward, I always get empty values. Any hint is appreciated.

OS: Ubuntu 20.04
Shibboleth SP: 3.0.4 (3.0.4+dfsg1-1ubuntu0.1)
libapache2-mod-shib: 3.0.4+dfsg1-1ubuntu0.1



[1] http://wiki.infn.it/_media/cn/ccr/aai/howto/attribute-map.xml
-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.com 
CTO @ YetOpen Srl

YetOpen - https://www.yetopen.com/

Via Salerno 18 - 23900 Lecco - ITALY -      | 4801 Glenwood Avenue - Suite 200 - Raleigh, NC 27612 - USA -
Tel +39 0341 220 205 - info.it at yetopen.com  | Phone +1 919-817-8106 - info.us at yetopen.com

Think green - Non stampare questa e-mail se non necessario / Don't print this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo 679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the sole use of the intended recipient and may contain confidential and privileged information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or distribution
is prohibited. If you are not the intended recepient please delete this message without copying, printing or forwarding it to others, and alert us as soon as possible.
Thank you.