Shib IdP Proxying to another IdP help

[Brent Goebel]

Hi Scott, 

So for each attribute with value that I want Shib-IdP to get from IdP-NEW, I'm going to have to modify the attribute-resolver entry for each of these attributes to include the NameFormat? If unspecified is the default, am I going to need to go add the NameFormat that the IdP-NEW notes as it's NameID format in it's metadata? 

If that is the case, the IdP-NEW NameID format is urn:oasis:names:tc:SAML:2.0:nameid-format:persistent. 

So going back to the givenName example, I would have to update the attribute-resolver entry for givenName to look like below? 

   <AttributeDefinition id="givenName" xsi:type="Simple">
        <InputDataConnector ref="myActiveDirectory" attributeNames="givenName" />
        <InputDataConnector ref="myActiveDirectoryLaw" attributeNames="givenName" />
        <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" encodeType="false" />
    </AttributeDefinition>

I tried this and I still get the same error. I don't think this is the right way as the format I'm using is based on the NameID. What is the correct NameFormat I would be using?  Can you assist in how the attribute example above to properly setup the NameFormat? 

2022-02-23 10:47:44,969 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'urn:oid:2.5.4.42'


Thank you,

Brent



-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Tuesday, February 22, 2022 4:56 PM
To: Shib Users <users at shibboleth.net>
Subject: [EXTERNAL] Re: Shib IdP Proxying to another IdP help

I added a few notes to the relevant documentation pages that highlight the issues with NameFormat defaults and, less helpfully to anybody now, added a comment to all the default rule files about it.

-- Scott

On 2/22/22, 6:19 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

    On 2/22/22, 5:56 PM, "users on behalf of Brent Goebel" <users-bounces at shibboleth.net on behalf of Brent.Goebel at du.edu> wrote:

    >    Going off your example of givenName. We are using the URN:OID. See the entry for it in our resolver below. 

    With no NameFormat constant in the Attribute element, so that is not a match. SAML naming is broken because a whole lot of people then and now refuse to accept URI naming of anything. It is not the default in SAML, but it is the default in Shibboleth, so the NameFormat constant has to be present and set properly or the default rules don't apply. You are using a NameFormat of "urn.....:unspecified", implied by its absence.


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NCZxaNi9jForCP_SxBKJCA!EgfGhkgxU7u5l3Xp4w1k8zj3acQexAcRPEcpaW_YDFXmt8_TofdQuPxFascz1r_w6Q$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net