Shib IdP Proxying to another IdP help

[Brent Goebel]

Hi Scott,

I can change the names being send as you recommended. So I went ahead and made the names unique. I went to the IdP-NEW configuration and updated the attributes to be released to Shib-IdP adding "PG" to the front of them (employeeID changed to PGemployeeID). 

On the Shib-IdP side, I added entries for all the attributes that IdP-NEW would be handing off. Example of employeeID below. I also updated the filter to match the new name. 

Attribute-resolver.xml 

    <AttributeDefinition id="PGemployeeID" xsi:type="Simple">
        <InputAttributeDefinition ref="employeeID" />
        <AttributeEncoder xsi:type="SAML2String" name="PGemployeeID" encodeType="false"/>
    </AttributeDefinition>


Attribute-filter.xml

        <AttributeRule attributeID="PGemployeeID">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>


After doing so, I tried again and I'm still seeing the same results. Is there something else I'm missing? Since I can modify the IdP-NEW side, I'd rather not create custom rules as you suggested. 


2022-02-22 15:08:01,729 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'PGemployeeID'



-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Tuesday, February 22, 2022 11:19 AM
To: Shib Users <users at shibboleth.net>
Subject: [EXTERNAL] Re: Shib IdP Proxying to another IdP help

On 2/22/22, 1:15 PM, "users on behalf of Brent Goebel" <users-bounces at shibboleth.net on behalf of Brent.Goebel at du.edu> wrote:

>    My apologies, I forgot to provide what I see in the logs. I'm seeing the "No transcoding rule for Attribute"
> show up for each attribute that is set in the attribute filter for 
> IdP-NEW. It appears to be that second possibility you mentioned, Scott 
> regarding the "decoding rules for the attribute names that are passing into the IdP from the other IdP." Can you please guide me on where to setup these decoding rules? Thanks.

Those are bogus/non-unique/non-standard attribute names, which is why there are no rules for them. And I wouldn't create them, personally, I'd change the names that are being sent, but that's up to you. In any event, the fix is adding custom rules to the attribute registry service. Either XML rulesets or small property files for each rule.

https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/display/IDP4/AttributeRegistryConfiguration__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW3ibEWl1Q$ 

-- Scott


--
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW19WTCMyw$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net