[Ext] [MARKETING] RE: [Ext] Help setting up a Java app protected by a Shib SP?

[Nate Klingenstein]

Bryan,

Marketing?  I'm wounded. ;D

Anyway, my hunch would be that those attributes just aren't being mapped at the SP.  Check attribute-map.xml, and again, /Shibboleth.sso/Session is a useful sanity check.  Beyond that, the logs should indicate that the SP is receiving attributes and dropping them.

If that's not it, and only a subset of attributes is being passed through, that would be well and truly weird.

Best always,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Bryan Wooten
Sent: Monday, March 29 2021, 11:22 am
To: Shib Users
Subject: Re: [Ext] [MARKETING] RE: [Ext] Help setting up a Java app protected by a Shib SP?

Thanks Nate:

I should have been more clear. When I go to:
https://idp.idm.utah.edu/idp/profile/admin/resolvertest?requester=https://idm.utah.edu&principal=someID <https://idp.idm.utah.edu/idp/profile/admin/resolvertest?requester=https://idm.utah.edu&principal=someID>

I see something like this: (and we aren't seeing "memberOf" / "uid", etc as headers?

name	"memberOf"
values
0	"CN=USS K Drive ffr-agile Folder,OU=USS Drive K permission Group,OU=USS Storage Permission Groups,OU=Groups,OU=University Support Services,OU=Department 
name	"uid"
values
0	"uxxxxxxx"
3
name	"eduPersonPrincipalName"
values
0	"xxxxxx at utah.edu <mailto:xxxxxx at utah.edu>"
4
name	"wso2publishermemberof"
values
0	"publisherrole"
5
name	"cn"
values
0	"uxxxxxxxx"
6
name	"somegroups"
values
0	"CurrentEmployees"
1	"uuMFA-DUO"
7
name	"mail"
values
0	"yyyyyy at utah.edu <mailto:yyyyyy at utah.edu>"

On 3/29/21, 10:46 AM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net <mailto:users-bounces at shibboleth.net> on behalf of ndk at signet.id <mailto:ndk at signet.id>> wrote:

    WARNING: Stop. Think. Read. This is an external email.

    Bryan,

    These look like attributes to me:

    subject-id ; pairwise-id ; eppn ; affiliation ; entitlement

    You can always perform the double-check at /Shibboleth.sso/Session, too.

    Take care,
    Nate.
    -- 
    For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>