Shib IdP Proxying to another IdP help

[Brent Goebel]

My apologies, I forgot to provide what I see in the logs. I'm seeing the "No transcoding rule for Attribute" show up for each attribute that is set in the attribute filter for IdP-NEW. It appears to be that second possibility you mentioned, Scott regarding the "decoding rules for the attribute names that are passing into the IdP from the other IdP." Can you please guide me on where to setup these decoding rules? Thanks.  


9:42:07,568 - 130.253.2.189 - DEBUG [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:329] - Profile Action ValidateAssertions: Assertion validation result was: VALID
2022-02-22 09:42:07,568 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:218] - Profile Action ProcessAssertionsForAuthentication: Removing 0 non-valid Assertions from Response
2022-02-22 09:42:07,568 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:237] - Profile Action ProcessAssertionsForAuthentication: Saw single suitable SAML Assertion, selecting for authentication
2022-02-22 09:42:07,568 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:249] - Profile Action ProcessAssertionsForAuthentication: Selected SAML Assertion for authentication: _53245015fb3ad3686c37b8bf9719fbb2
2022-02-22 09:42:07,568 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:254] - Profile Action ProcessAssertionsForAuthentication: Saw single AuthnStatement, selecting for authentication
2022-02-22 09:42:07,569 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:384] - Profile Action ValidateSAMLAuthentication: Decoding incoming SAML Attributes
2022-02-22 09:42:07,569 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'employeeID'
2022-02-22 09:42:07,569 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'mail'
2022-02-22 09:42:07,569 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'surname'
2022-02-22 09:42:07,569 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'UDC_IDENTIFIER'
2022-02-22 09:42:07,569 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'givenName'
2022-02-22 09:42:07,569 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'uid'
2022-02-22 09:42:07,569 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:414] - Profile Action ValidateSAMLAuthentication: Incoming SAML Attributes mapped to attribute IDs: []
2022-02-22 09:42:07,570 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:302] - Profile Action ValidateSAMLAuthentication: Added translated AuthnContext Principals: [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]
2022-02-22 09:42:07,570 - 130.253.2.189 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:277] - Profile Action ValidateSAMLAuthentication: Resetting authentication time to proxied value: 2022-02-22T16:42:07Z
2022-02-22 09:42:07,571 - 130.253.2.189 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:75] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectCanonicalizationContext

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Tuesday, February 22, 2022 10:45 AM
To: Shib Users <users at shibboleth.net>
Subject: [EXTERNAL] Re: Shib IdP Proxying to another IdP help

Generally speaking, the answer is going to be in your logs. If it's relaying the client back to the SP and the issue is just that the attributes are missing, then most likely they're being filtered out (so your policy is incorrect in some way and it should log that they're being filtered out) or you don't have decoding rules for the attribute names that are passing into the IdP from the other IdP because it isn't using standard naming or there are custom attributes involved (which should also be logged).

That is also not the documentation. The docs cover what you have to do, and they're written by the author. How Tos are (usually) not and are rarely up to date. They're fine as a supplement, they're never the right starting point.

4.0 is of course also EOL, and there are some improvements to configuring proxying support in 4.1.

-- Scott


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NCZxaNi9jForCP_SxBKJCA!EA7-K1e4cz9-_3kZKkNWBsIVypgPQ6DNLHqiIwaYT1Gu2h7BAmF3JNPDOLAcddNtog$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net