Add attributes map to SP3 (supann)

[jehan.procaccia at tem-tsp.eu]

Hello

in our federation we use "Supann" attributes, French extension to 
eduPerson/SCHAC schema .

/https://services.renater.fr/documentation/supann/supann2021/recommandations/attributs/liste_des_attributs/

I successfully enabled the resolution and sending (filter) from our IDP 
v4 (cf/idp-process.log/ below [1] )

/aacli /also shows correct resolutions and values [2]

but on the SP side, I cannot get/map those added supann attributes, only 
eduperson attributes shows up [3]

I declared the expected supann attributes in my SP3 
in/attribute-map.xml/ , example here for /supannRessourceEtat /

<Attribute name="urn:oid:1.3.6.1.4.1.7135.1.2.1.55" 
id="supannRessourceEtat">
         <AttributeDecoder xsi:type="StringAttributeDecoder" 
caseSensitive="false"/>
     </Attribute>

On the IDP4 it is also declared in conf/attributes/supann.xml

/<bean parent="shibboleth.TranscodingProperties">
             <property name="properties">
                 <props merge="true">
                     <prop key="id">supannRessourceEtat</prop>
                     <prop key="transcoder">SAML2StringTranscoder 
SAML1StringTranscoder</prop>
                     <prop 
key="saml2.name">urn:oid:1.3.6.1.4.1.7135.1.2.1.55</prop>
                     <prop 
key="saml1.name">urn:renater:dir:attribute-def:supannRessourceEtat</prop>
                     <prop key="displayName.en">supannRessourceEtat</prop>
                     <prop key="displayName.de">supannRessourceEtat</prop>
                     <prop key="displayName.fr">supannRessourceEtat</prop>
                     <prop key="displayName.it">supannRessourceEtat</prop>
                     <prop key="description.en">Validity state of a 
ressource or account</prop>
                     <prop key="description.fr">État de validité d'une 
ressource ou d'un compte</prop>
                 </props>
             </property>
         </bean>/

according to the documentation: 
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335311/AddAttribute 


I think I did everything necessary , except perhaps a pb of 
AttributeNamespace or Decoder ?, and/or the fact that it is a 
multivalued attribute ?

I also set /log4j.rootCategory=DEBUG/ in shibd.logger , but perhaps 
there is other subcategories to add debug to in order the debug 
attribute mapping problems ?

Please let me know what else can I do in order to map this attribute.

Regards

[1]

/procaccia|https://fres.tsp.eu/sp|_6cd1b6bdeb39bd81b1e71992fadddb4f|password|2023-01-11T22:04:19.818128Z|/

/*supannEntiteAffectation*,mail,eduPersonAffiliation,displayName,givenName,eduPersonPrincipalName,sn,*supannAutreMail,supannRessourceEtat*|/

/AAdzZWNyZXQx6+LtDNZSaSWPOiwPHg7A8TvwnZB2/7+yUswh/72....9vaRIEvgCk=|transient|false|false||Redirect|POST||Success|/

/|994879436....360|Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 
(KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36/


[2] /
/

/[root at idp4 shibboleth-idp]# ./bin/aacli.sh 
--requester=https://fres.tsp.eu/sp --configDir=conf/ --principal=procaccia/
{
     "name": "supannRessourceEtat",
     "values": [
         "{REST}A:Premium",
         "{TR}A:SupannActif",
         "{ECAMPUS}A:SupannActif",


[3]

/2023-01-11 23:04:23 DEBUG Shibboleth.AttributeFilter [2] [default]: 
filtering 6 attribute(s) from (https://idp4.tsp.eu/idp/shibboleth)
2023-01-11 23:04:23 DEBUG Shibboleth.AttributeFilter [2] [default]: 
applying filtering rule(s) for attribute (givenName) from 
(https://idp4.tsp.eu/idp/shibboleth)
2023-01-11 23:04:23 DEBUG Shibboleth.AttributeFilter [2] [default]: 
applying filtering rule(s) for attribute (displayName) from 
(https://idp4.tsp.eu/idp/shibboleth)
2023-01-11 23:04:23 DEBUG Shibboleth.AttributeFilter [2] [default]: 
applying filtering rule(s) for attribute (mail) from 
(https://idp4.tsp.eu/idp/shibboleth)
2023-01-11 23:04:23 DEBUG Shibboleth.AttributeFilter [2] [default]: 
applying filtering rule(s) for attribute (unscoped-affiliation) from 
(https://idp4.tsp.eu/idp/shibboleth)
2023-01-11 23:04:23 DEBUG Shibboleth.AttributeFilter [2] [default]: 
applying filtering rule(s) for attribute (eppn) from 
(https://idp4.tsp.eu/idp/shibboleth)
2023-01-11 23:04:23 DEBUG Shibboleth.AttributeFilter [2] [default]: 
applying filtering rule(s) for attribute (sn) from 
(https://idp4.tsp.eu/idp/shibboleth)
2023-01-11 23:04:23 DEBUG Shibboleth.SessionCache [2] [default]: 
creating new session/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230112/09e9319b/attachment.htm>