[External] Re: attribute-filter.xml question

[Zhang, Jianjun]

Thanks for the reply!

I finally figured this one out. For anyone that might run into the same problem, the issue is that when I used release attributes to ANY, the permission applies to both inbound (from the upstream idp) and the outbound (to the SP). So it worked and all attributes were able to resolve without issue.

When I changed it to only release to certain SP, the attributes were not allowed in from the upstream idp, it then complained about attributes reseolved to null. Adding specific permission to allow the inbound attributes from the upstream idp makes it work again.

<AttributeFilterPolicy id="allow-inbound-idp">
        <PolicyRequirementRule xsi:type="Inbound" />
    <AttributeRule attributeID="name" permitAny="true" />
    <AttributeRule attributeID="mail" permitAny="true" />
</AttributeFilterPolicyGroup>

<AttributeFilterPolicy id="saml-proxy-pass-through">
        <PolicyRequirementRule xsi:type="Requester" value="https://sp.example.com/sp" />
        <AttributeRule attributeID="name" permitAny="true" />
        <AttributeRule attributeID="mail" permitAny="true" />
 </AttributeFilterPolicy>

This is all it needs to make it work to release the two attributes only to https://sp.example.com/sp.

Thanks,

Johnny Z.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Rod Widdowson <rdw at steadingsoftware.com>
Sent: Sunday, April 23, 2023 4:36 AM
To: Shib Users <users at shibboleth.net>
Subject: [External] Re: attribute-filter.xml question

You don't often get email from rdw at steadingsoftware.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>

This message is from an EXTERNAL SENDER - be CAUTIOUS of links and attachments. THINK BEFORE YOU CLICK.
________________________________



The logs say name and mail resolved to null in this case.

Attribute resolution happens long before attribute filtering.  So the configuration of the attribute filter can have no effect on that.  So either something else is changing or the logs are not telling you what they think are telling you.

Both the attribute resolver and the attribute filter give pretty good logging information at debug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230424/73424498/attachment.htm>