Shib IdP Proxying to another IdP help

[IAM David Bantz]

 just checking: you are reloading the attribute-resolver,
attribute-registry, and attribute-filter files after updates

On 22Feb2022 at 13:15:17, Brent Goebel <Brent.Goebel at du.edu> wrote:

> Hi Scott,
>
> I can change the names being send as you recommended. So I went ahead and
> made the names unique. I went to the IdP-NEW configuration and updated the
> attributes to be released to Shib-IdP adding "PG" to the front of them
> (employeeID changed to PGemployeeID).
>
> On the Shib-IdP side, I added entries for all the attributes that IdP-NEW
> would be handing off. Example of employeeID below. I also updated the
> filter to match the new name.
>
> Attribute-resolver.xml
>
>    <AttributeDefinition id="PGemployeeID" xsi:type="Simple">
>        <InputAttributeDefinition ref="employeeID" />
>        <AttributeEncoder xsi:type="SAML2String" name="PGemployeeID"
> encodeType="false"/>
>    </AttributeDefinition>
>
>
> Attribute-filter.xml
>
>        <AttributeRule attributeID="PGemployeeID">
>            <PermitValueRule xsi:type="ANY" />
>        </AttributeRule>
>
>
> After doing so, I tried again and I'm still seeing the same results. Is
> there something else I'm missing? Since I can modify the IdP-NEW side, I'd
> rather not create custom rules as you suggested.
>
>
> 2022-02-22 15:08:01,729 - 130.253.2.189 - INFO
> [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443]
> - Profile Action ValidateSAMLAuthentication: No transcoding rule for
> Attribute 'PGemployeeID'
>
>
>
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
> Sent: Tuesday, February 22, 2022 11:19 AM
> To: Shib Users <users at shibboleth.net>
> Subject: [EXTERNAL] Re: Shib IdP Proxying to another IdP help
>
> On 2/22/22, 1:15 PM, "users on behalf of Brent Goebel" <
> users-bounces at shibboleth.net on behalf of Brent.Goebel at du.edu> wrote:
>
>    My apologies, I forgot to provide what I see in the logs. I'm seeing
> the "No transcoding rule for Attribute"
>
> show up for each attribute that is set in the attribute filter for
>
> IdP-NEW. It appears to be that second possibility you mentioned, Scott
>
> regarding the "decoding rules for the attribute names that are passing
> into the IdP from the other IdP." Can you please guide me on where to setup
> these decoding rules? Thanks.
>
>
> Those are bogus/non-unique/non-standard attribute names, which is why
> there are no rules for them. And I wouldn't create them, personally, I'd
> change the names that are being sent, but that's up to you. In any event,
> the fix is adding custom rules to the attribute registry service. Either
> XML rulesets or small property files for each rule.
>
>
> https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/display/IDP4/AttributeRegistryConfiguration__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW3ibEWl1Q$
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW19WTCMyw$
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220222/1a527772/attachment.htm>