attribute-filter.xml question

[Zhang, Jianjun]

Hi,

I have a shibboleth idp 4.3 setup that works perfectly if I put attributes on alwaysRelease, like this:

<AttributeFilterPolicy id="alwaysRelease">
        <PolicyRequirementRule xsi:type="ANY" />
        <AttributeRule attributeID="proxied-uid" permitAny="true" />
        <AttributeRule attributeID="name" permitAny="true" />
        <AttributeRule attributeID="mail" permitAny="true" />
</AttributeFilterPolicy>

I get all attributes.
But if I want to only release the latter two attributes to specific relying party, like this:

<AttributeFilterPolicy id="alwaysRelease">
        <PolicyRequirementRule xsi:type="ANY" />
        <AttributeRule attributeID="proxied-uid" permitAny="true" />
</AttributeFilterPolicy>
<AttributeFilterPolicy id="saml-proxy-pass-through">
        <PolicyRequirementRule xsi:type="Requester" value="https://sp.example.com/sp" />
        <AttributeRule attributeID="name" permitAny="true" />
        <AttributeRule attributeID="mail" permitAny="true" />
 </AttributeFilterPolicy>

I then only get proxied-uid, not the other two attributes. "https://sp.example.com/sp"<https://sp.example.com/sp> is exactly the relying party entityID. I am puzzled why this would not work. The logs say name and mail resolved to null in this case. But it is all ok in the first scenario while no other changes are involved.

Are there any other configurations that might impact the attribute release?

Thanks a lot for any help.

Johnny Z.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230422/631fb163/attachment.htm>