Add attributes map to SP3 (supann)

Fri Jan 13 19:12:11 UTC 2023

I did restarted shibd 
for the second most obvious pb, perhaps the IDP finally doesn't sent the attributes, although I did restarted tomcat, and in idp-process.log [1] I do see the attribute beeing mentioned (and it does resolves with aacli ) 
I am lost, where should I try to resolve this problem, on the IDP side and/or SP side ? my supann* attributes seems to get lost in between 

[1] ID process log , attribute are there (in bold), so for me IDP is not the pb 

https://fres.tsp.eu/sp|AttributeReleaseConsent|procacci|mail||true 
2023-01-13 19:46:24,181 - 157.159.52.132 - INFO [Shibboleth-Audit.SSO:283] - 152.157.52.12|2023-01-13T18:45:51.022299Z|2023-01-13T18:46:24.181871Z|procacci|https://fres.tsp.eu/shibboleth|_9cac...7a9|password|2023-01-13T18:46:09.145114Z| supannEntiteAffectation ,mail,eduPersonAffiliation,displayName,givenName,eduPersonPrincipalName,sn, supannAutreMai l, supannRessourceEtat| 

[2] on the shibd/SP side, shid.log in debug mode, doesn't show the supann* attributes in the saml assertion, but do show 2 unable to extract attributes, unknown XML object type: saml2p:Response cf below 

<saml2:AttributeStatement><saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>PROCACCIA</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>procaccia at tsp.eu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>member</saml2:AttributeValue><saml2:AttributeValue>employee</saml2:AttributeValue><saml2:AttributeValue>staff</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>jehan.procaccia at tsp.eu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="displayName" Name="urn:oid:2.16.840.1.113730.3.1.241" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Jehan PROCACCIA</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Jehan</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion></saml2p:Response> 

.... 

2023-01-13 19:46:24 DEBUG XMLTooling.Signature [2] [default]: unmarshalling ds:Signature 
2023-01-13 19:46:24 DEBUG OpenSAML.MessageDecoder.SAML2 [2] [default]: extracting issuer from SAML 2.0 protocol message 
2023-01-13 19:46:24 DEBUG OpenSAML.MessageDecoder.SAML2 [2] [default]: message from (https://idp4.tsp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG OpenSAML.MessageDecoder.SAML2 [2] [default]: searching metadata for message issuer... 
2023-01-13 19:46:24 DEBUG OpenSAML.MessageDecoder.SAML2 [2] [default]: recovered request/response correlation value (_140309e48ee414a6e0a701a660aa17cf) 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [2] [default]: evaluating message flow policy (correlation off, replay checking on, expiration 60) 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [2] [default]: ignoring InResponseTo, correlation checking is disabled 
2023-01-13 19:46:24 DEBUG XMLTooling.StorageService [2] [default]: inserted record (_67c81fd930ad5583b696d618d392d035) in context (MessageFlow) with expiration (1673635824) 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [2] [default]: validating signature profile 
2023-01-13 19:46:24 DEBUG XMLTooling.CredentialCriteria [2] [default]: keys didn't match 
2023-01-13 19:46:24 DEBUG XMLTooling.TrustEngine.ExplicitKey [2] [default]: attempting to validate signature with the peer's credentials 
2023-01-13 19:46:24 DEBUG XMLTooling.TrustEngine.ExplicitKey [2] [default]: signature validated with credential 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [2] [default]: signature verified against message issuer 
2023-01-13 19:46:24 DEBUG Shibboleth.SSO.SAML2 [2] [default]: processing message against SAML 2.0 SSO profile 
2023-01-13 19:46:24 DEBUG Shibboleth.SSO.SAML2 [2] [default]: extracting issuer from SAML 2.0 assertion 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [2] [default]: evaluating message flow policy (correlation off, replay checking on, expiration 60) 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [2] [default]: ignoring InResponseTo, correlation checking is disabled 
2023-01-13 19:46:24 DEBUG XMLTooling.StorageService [2] [default]: inserted record (_9cac9d8e377ba2aee7914847b79117a9) in context (MessageFlow) with expiration (1673635824) 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [2] [default]: ignoring InResponseTo, correlation checking is disabled 
2023-01-13 19:46:24 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [2] [default]: assertion satisfied bearer confirmation requirements 
2023-01-13 19:46:24 DEBUG Shibboleth.SSO.SAML2 [2] [default]: SSO profile processing completed successfully 
2023-01-13 19:46:24 DEBUG Shibboleth.SSO.SAML2 [2] [default]: extracting pushed attributes... 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeExtractor.XML [2] [default]: unable to extract attributes, unknown XML object type: saml2p:Response 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeExtractor.XML [2] [default]: skipping NameID with format (urn:oasis:names:tc:SAML:2.0:nameid-format:transient) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeExtractor.XML [2] [default]: unable to extract attributes, unknown XML object type: saml2:AuthnStatement 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeDecoder.String [2] [default]: decoding SimpleAttribute (sn) from SAML 2 Attribute (urn:oid:2.5.4.4) with 1 value(s) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeDecoder.Scoped [2] [default]: decoding ScopedAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeDecoder.String [2] [default]: decoding SimpleAttribute (unscoped-affiliation) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.1) with 3 value(s) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeDecoder.String [2] [default]: decoding SimpleAttribute (mail) from SAML 2 Attribute (urn:oid:0.9.2342.19200300.100.1.3) with 1 value(s) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeDecoder.String [2] [default]: decoding SimpleAttribute (displayName) from SAML 2 Attribute (urn:oid:2.16.840.1.113730.3.1.241) with 1 value(s) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeDecoder.String [2] [default]: decoding SimpleAttribute (givenName) from SAML 2 Attribute (urn:oid:2.5.4.42) with 1 value(s) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeFilter [2] [default]: filtering 6 attribute(s) from (https://idp4.tsp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeFilter [2] [default]: applying filtering rule(s) for attribute (givenName) from (https://idp4.tsp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeFilter [2] [default]: applying filtering rule(s) for attribute (displayName) from (https://idp4.tsp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeFilter [2] [default]: applying filtering rule(s) for attribute (mail) from (https://idp4.tsp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeFilter [2] [default]: applying filtering rule(s) for attribute (unscoped-affiliation) from (https://idp4.tsp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeFilter [2] [default]: applying filtering rule(s) for attribute (eppn) from (https://idp4.sp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG Shibboleth.AttributeFilter [2] [default]: applying filtering rule(s) for attribute (sn) from (https://idp4.tsp.eu/idp/shibboleth) 
2023-01-13 19:46:24 DEBUG Shibboleth.SessionCache [2] [default]: creating new session 
2023-01-13 19:46:24 DEBUG Shibboleth.SessionCache [2] [default]: storing new session... 
2023-01-13 19:46:24 DEBUG XMLTooling.StorageService [2] [default]: inserted record (session) in context (_0ac069 ...567) 

De: "Cantor, Scott via users" <users at shibboleth.net> 
À: "Shib Users" <users at shibboleth.net> 
Cc: "Scott Cantor" <cantor.2 at osu.edu> 
Envoyé: Vendredi 13 Janvier 2023 13:59:32 
Objet: Re: Add attributes map to SP3 (supann) 

The most obvious problem would be not restarting shibd, and the second most obvious is that it's not even there and the IdP registry service wasn't reloaded. 

-- Scott 

-- 
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230113/d3ad1ae3/attachment.htm>