Unable to get Shibboleth SP to recognize attribute

[Wessel, Keith]

If the SP is receiving the attribute, you should either see it in the trans log or as an unmapped attribute if something were configured wrong in the shibd log. Does the IdP's audit log indicate that it's being released? You did remember to add it to the attribute filter config for that SP on your IdP, right?

Worst case, you could turn off encrypted assertions temporarily to that SP and use a SAML tracer plugin in the browser to see what's being released, or you could simply turn on logging of the SAML responses that the IdP's generating to see what the IdP says it's sending.

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Ullfig, Roberto Alfredo via users
Sent: Friday, September 16, 2022 9:37 AM
To: Shib Users <users at shibboleth.net>
Cc: Ullfig, Roberto A (UIC) <rullfig at uic.edu>
Subject: Unable to get Shibboleth SP to recognize attribute

I created a new attribute in resolver:

    <AttributeDefinition id="acccPersonSecondary" xsi:type="Simple">
        <InputDataConnector ref="Portal" attributeNames="acccPersonSecondary"/>
        <AttributeEncoder xsi:type="SAML1String" name="urn:mace:uic.edu:attribute-def:acccPersonSecondary" encodeType="false"/>
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.8460.1.2.208" friendlyName="acccPersonSecondary" encodeType="false" />
    </AttributeDefinition>

2022-09-16 09:26:36,423 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:140] - [D1976DC464E0BC98FC89D4D470F5ED0B] - [128.248.2.59] - Attribute Definition 'acccPersonSecondary': produced an attribute with the following values [StringAttributeValue{value=true}]

It's being released to the SP. The SP has this in the attribute map:

    <Attribute name="urn:oid:1.3.6.1.4.1.8460.1.2.208" id="shibattr-acccPersonSecondary"/>

I turned on debug in logger.xml and except for:

2022-09-16 09:26:12 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oid:1.3.6.1.4.1.8460.1.2.208

there is no reference to the attribute. What am I doing wrong?

---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220916/2ef1d878/attachment.htm>