Shibbolet SP: empty attributes

[Nate Klingenstein]

Lorenzo,

There isn't enough information in here for us to help you.  What is the attribute named in the SAML assertion?  Nextcloud is apparently willing to take any attribute it receives and arbitrarily map it to username, or has this attribute preconfigured in it.  It is unlikely that it's using the name from the umsystem.edu namespace consciously.

We need to know the nameFormat and the name of the attribute.  If the username is being sent as just plain "sAMAccountName" with an unspecified nameID, I wouldn't be surprised at all to see it fail.

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Lorenzo Milesi via users
Sent: Monday, July 19 2021, 4:55 pm
To: users at shibboleth.net
Cc: Lorenzo Milesi
Subject: Shibbolet SP: empty attributes

Hi. 
I've configured an IdP with SimpleSamlPHP with auth against Active Directory, tested with Nextcloud as SP and authenticates correctly.

Now I'm trying to add Apache2 and mod_shib but I get empty attributes after authentication.
In SSP when I test auth I can see all the returned user information from the IdP, and it has all the AD LDAP entries. Username is sAMAccountName.

When visiting /Shibboleth.sso/Session on the SP:

Miscellaneous
Session Expiration (barring inactivity): 461 minute(s)
Client Address: 84.1.2.90
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: https://auth.domain.com/sso/saml2/idp/metadata.php <https://auth.domain.com/sso/saml2/idp/metadata.php>
Authentication Time: 2021-07-19T15:39:50Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributes

As attribute-map.xml I'm using [1] with added
    <Attribute name="urn:mace:umsystem.edu:attribute-def:samAccountName" id="samaccountname">
        <AttributeDecoder xsi:type="StringAttributeDecoder"   caseSensitive="false"/>
    </Attribute>

In shibboleth2.xml I added:
    <ApplicationDefaults entityID="https://test2021.domain.com/shibboleth <https://test2021.domain.com/shibboleth>"
        REMOTE_USER="sAMAccountName uid eseppn subject-id pairwise-id persistent-id"
        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">

I tried several guides but I'm unable to move forward, I always get empty values. Any hint is appreciated.

OS: Ubuntu 20.04
Shibboleth SP: 3.0.4 (3.0.4+dfsg1-1ubuntu0.1)
libapache2-mod-shib: 3.0.4+dfsg1-1ubuntu0.1

[1] http://wiki.infn.it/_media/cn/ccr/aai/howto/attribute-map.xml <http://wiki.infn.it/_media/cn/ccr/aai/howto/attribute-map.xml>
-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.com <mailto:lorenzo.milesi at yetopen.com> 
CTO @ YetOpen Srl

YetOpen - https://www.yetopen.com <https://www.yetopen.com>/

Via Salerno 18 - 23900 Lecco - ITALY -      | 4801 Glenwood Avenue - Suite 200 - Raleigh, NC 27612 - USA -
Tel +39 0341 220 205 - info.it at yetopen.com <mailto:info.it at yetopen.com>  | Phone +1 919-817-8106 - info.us at yetopen.com <mailto:info.us at yetopen.com>

Think green - Non stampare questa e-mail se non necessario / Don't print this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo 679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the sole use of the intended recipient and may contain confidential and privileged information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or distribution
is prohibited. If you are not the intended recepient please delete this message without copying, printing or forwarding it to others, and alert us as soon as possible.
Thank you.

-- 
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw <https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>