Shib IdP Proxying to another IdP help

[Brent Goebel]

Scott - thanks for being so patient and explaining this to me. I got the transcoding error to go away by adding those attributes to /conf/attributes/custom

I did get stuck on the ' Subject Canonicalisation' step of the document below.  
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP 

Digging around I saw that the c14n/attribute flow was not enabled. So I went into conf/c14/subject-c14n.xml and uncommented it. Once I did that, the proxy/idp chaining worked! 

Thanks again for taking the time to outline this for me. 

Brent

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Wednesday, February 23, 2022 6:02 PM
To: Shib Users <users at shibboleth.net>
Subject: [EXTERNAL] Re: Shib IdP Proxying to another IdP help

You just told it to change the Attribute *Name* it's sending you. That's not the NameFormat. They're not the same field in the XML. I didn't say to rename the Attribute. I have no idea if this IdP is even capable of handling this, and if it's not, then I've said what you need to do; you need to create new transcoder rules that will match by specifying the same Name but the unspecified NameFormat.

And as I keep saying, this has nothing to with the attribute resolver configuration. That is not how you fix the issue. Please read the material on the AttributeRegistry feature. That is the configuration that controls the rules for decoding things (and it doubles as the easiest way to encode them now as well).

If you have an Attribute like this:

        <Attribute Name="givenName">

Then you need to create a rule in the registry that matches

$ vi idp/conf/attributes/custom/givenName.properties

id = givenName
transcoder = SAML2StringTranscoder
saml2.name = givenName
saml2.nameFormat = urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified

That's what it takes to get it decoded.

-- Scott


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NCZxaNi9jForCP_SxBKJCA!Bx94noXgmfg8wMu2-F2Y7zo3NaCdgi73PSK-KtUmqP2teSCcRDYSjNu7MNMqh1LEPw$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net