SAML IDP-Proxy woes

[Mårtensson, Roger]

Hello!

I'm working on setting up a Shibboleth 4.1 Proxy to another IDP. I got some help before and I managed to get it to work against another Shibboleth IDP.
The next step in our quest is to get everything set up to our ADFS-service.

I am using this link as a inspiration: https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD

I've got it to connect to the ADFS-service where I can login and get a response. And it's here I need some help to guide me in the right direction.

After the response is received I can see in the debug log that is translating the ADFS-claims to my chosen attribute names.
But after all my Attribute Filters have been processed there is nothing. Not one of my attributes received in the Claim is released.

This, of course, makes the DataConnector resolving to nothing and my SubjectDerivedAttribute generating no values.

What am I missing? (Or what am I not understanding?)

My attribute-filter.xml is setup as found in the link above exception I'm not using ScopeMatchesShibMDScope. All my ADFS-Claims are translated using SAML2StringTranscoder.

This is a subset of what I'm seeing in the log.

2021-05-11 14:31:37,320 - 11.22.33.44 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeFilterPolicy:119] - Attribute Filter Policy 'saml-proxy-pass-through'  Checking if attribute filter policy is active
2021-05-11 14:31:37,321 - 11.22.33.44 - DEBUG [net.shibboleth.idp.attribute.filter.policyrule.filtercontext.impl.AttributeIssuerPolicyRule:54] - Attribute Filter '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/PolicyRequirementRule:_02ce2c71348deed4303d897e999c36ee': Found attribute issuer: http://ouradfsserver.example.com/adfs/services/trust
2021-05-11 14:31:37,321 - 11.22.33.44 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeFilterPolicy:126] - Attribute Filter Policy 'saml-proxy-pass-through'  Policy is active for this request
2021-05-11 14:31:37,321 - 11.22.33.44 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeFilterPolicy:153] - Attribute Filter Policy 'saml-proxy-pass-through'  Applying attribute filter policy to current set of attributes: ["adfs-givenname", "adfs-surname", "adfs-emailaddress"]
2021-05-11 14:31:37,321 - 11.22.33.44 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:165] - Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted release of attribute "adfs-givenname" values
2021-05-11 14:31:37,321 - 11.22.33.44 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:165] - Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted release of attribute "adfs-surname" values
2021-05-11 14:31:37,321 - 11.22.33.44 - DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:165] - Attribute filtering engine 'ShibbolethAttributeFilter': no policy permitted release of attribute "adfs-emailaddress" values

Yours,
Roger

MID SWEDEN UNIVERSITY
Information about the processing of personal data at Mid Sweden University: www.miun.se/en/personaldata<http://www.miun.se/en/personaldata>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210511/845b5056/attachment.htm>