Not getting attributes

[Nate Klingenstein]

Lee,

> 2021-03-31 14:03:09 INFO Shibboleth.AttributeExtractor.XML [1] [default]: skipping SAML 2.0 Attribute with Name: email address, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified

All attribute Names are presumed in the default configuration to be specification-compliant, and all the attributes'  NameFormats are defaulted to urn:oasis:names:tc:SAML:2.0:attrname-format:uri.  You can add your own attributes, of course, but they should use attributes that are declared in a namespace that you own and using a NameFormat that is, well, actually specified.  As it is, your "email address" would be highly likely to collide with someone else's email address, and they may have completely different semantics, such as which characters are permitted and whether multiple values are allowed.  It's best to use a standard attribute if possible, and if not, define your own and make that definition clear, and when confronted by this, bite the bullet and map the attribute anyway.

> I am not sure what I am missing.

Attributes mappings.  Keeping in mind all the above about this being a bad set of attributes, you can accept the attributes that you're receiving right now without any modification to the IdP by adding the following to /etc/shibboleth/attribute-map.xml:

<Attribute name="email address" id="mail" />
<Attribute name="FirstName" id="firstName" />
<Attribute name="LastName" id="lastName />
<Attribute name="eduperson Principal Name" id="eduPersonPrincipalName" />

Note that the last one is particularly ugly, since it does have a well-specified and widely-used SAML and LDAP name, but it'll work.

https://wiki.shibboleth.net/confluence/display/SP3/XMLAttributeExtractorExamples

I'm not entirely sure that you can have spaces in an attribute name, but you probably can.  I haven't validated that unspecified attribute NameFormats are passed through, but the Wiki is my holy book, and I follow its writings to the Cantor 3:21.

The better long-term fix would be for the IdP to release standard attribute names, but I fully understand what a challenge that is.

Best,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id