Shibbolet SP: empty attributes

Tue Jul 20 03:41:13 UTC 2021

Indeed in NC I've set mapping of the user field to "sAMAccountName" attribute.

I'll investigate on the IdP configuration. thanks

----- Original Message -----
> From: "Nate Klingenstein" <ndk at signet.id>
> To: "users" <users at shibboleth.net>, "users" <users at shibboleth.net>
> Cc: "Lorenzo Milesi" <lorenzo.milesi at yetopen.com>
> Sent: Monday, July 19, 2021 7:45:14 PM
> Subject: RE: Shibbolet SP: empty attributes

> Lorenzo,
> 
> There isn't enough information in here for us to help you.  What is the
> attribute named in the SAML assertion?  Nextcloud is apparently willing to take
> any attribute it receives and arbitrarily map it to username, or has this
> attribute preconfigured in it.  It is unlikely that it's using the name from
> the umsystem.edu namespace consciously.
> 
> We need to know the nameFormat and the name of the attribute.  If the username
> is being sent as just plain "sAMAccountName" with an unspecified nameID, I
> wouldn't be surprised at all to see it fail.
> 
> Take care,
> Nate.
> 
> --------
> Signet, Inc.
> The Art of Access ®
> 
> https://www.signet.id
> 
> -----Original message-----
> From: Lorenzo Milesi via users
> Sent: Monday, July 19 2021, 4:55 pm
> To: users at shibboleth.net
> Cc: Lorenzo Milesi
> Subject: Shibbolet SP: empty attributes
> 
> Hi.
> I've configured an IdP with SimpleSamlPHP with auth against Active Directory,
> tested with Nextcloud as SP and authenticates correctly.
> 
> Now I'm trying to add Apache2 and mod_shib but I get empty attributes after
> authentication.
> In SSP when I test auth I can see all the returned user information from the
> IdP, and it has all the AD LDAP entries. Username is sAMAccountName.
> 
> When visiting /Shibboleth.sso/Session on the SP:
> 
> Miscellaneous
> Session Expiration (barring inactivity): 461 minute(s)
> Client Address: 84.1.2.90
> SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
> Identity Provider: https://auth.domain.com/sso/saml2/idp/metadata.php
> <https://auth.domain.com/sso/saml2/idp/metadata.php>
> Authentication Time: 2021-07-19T15:39:50Z
> Authentication Context Class:
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
> Authentication Context Decl: (none)
> 
> Attributes
> 
> As attribute-map.xml I'm using [1] with added
>    <Attribute name="urn:mace:umsystem.edu:attribute-def:samAccountName"
>    id="samaccountname">
>        <AttributeDecoder xsi:type="StringAttributeDecoder"   caseSensitive="false"/>
>    </Attribute>
> 
> In shibboleth2.xml I added:
>    <ApplicationDefaults entityID="https://test2021.domain.com/shibboleth
>    <https://test2021.domain.com/shibboleth>"
>        REMOTE_USER="sAMAccountName uid eseppn subject-id pairwise-id persistent-id"
>        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
> 
> I tried several guides but I'm unable to move forward, I always get empty
> values. Any hint is appreciated.
> 
> OS: Ubuntu 20.04
> Shibboleth SP: 3.0.4 (3.0.4+dfsg1-1ubuntu0.1)
> libapache2-mod-shib: 3.0.4+dfsg1-1ubuntu0.1
> 
> [1] http://wiki.infn.it/_media/cn/ccr/aai/howto/attribute-map.xml
> <http://wiki.infn.it/_media/cn/ccr/aai/howto/attribute-map.xml>
> --
> Lorenzo Milesi - lorenzo.milesi at yetopen.com <mailto:lorenzo.milesi at yetopen.com>
> CTO @ YetOpen Srl
> 
> YetOpen - https://www.yetopen.com <https://www.yetopen.com>/
> 
> Via Salerno 18 - 23900 Lecco - ITALY -      | 4801 Glenwood Avenue - Suite 200 -
> Raleigh, NC 27612 - USA -
> Tel +39 0341 220 205 - info.it at yetopen.com <mailto:info.it at yetopen.com>  | Phone
> +1 919-817-8106 - info.us at yetopen.com <mailto:info.us at yetopen.com>
> 
> Think green - Non stampare questa e-mail se non necessario / Don't print this
> email unless necessary
> 
> -------- D.Lgs. 196/2003 e GDPR 679/2016 --------
> Tutte le informazioni contenute in questo messaggio sono riservate ed a uso
> esclusivo del destinatario.
> Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da
> ritenere confidenziali e riservate secondo i termini
> del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo
> 679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non
> autorizzata.
> Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad
> eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci
> non appena possibile.
> Grazie.
> 
> Confidentiality notice: this email message including any attachment is for the
> sole use of the intended recipient and may contain confidential and privileged
> information;
> pursuant to Legislative Decree 196/2003 and the European General Data Protection
> Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or
> distribution
> is prohibited. If you are not the intended recepient please delete this message
> without copying, printing or forwarding it to others, and alert us as soon as
> possible.
> Thank you.
> 
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> <https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> <mailto:users-unsubscribe at shibboleth.net>

-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.com 
CTO @ YetOpen Srl

YetOpen - https://www.yetopen.com/

Via Salerno 18 - 23900 Lecco - ITALY -      | 4801 Glenwood Avenue - Suite 200 - Raleigh, NC 27612 - USA -
Tel +39 0341 220 205 - info.it at yetopen.com  | Phone +1 919-817-8106 - info.us at yetopen.com

Think green - Non stampare questa e-mail se non necessario / Don't print this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo 679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the sole use of the intended recipient and may contain confidential and privileged information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or distribution
is prohibited. If you are not the intended recepient please delete this message without copying, printing or forwarding it to others, and alert us as soon as possible.
Thank you.