Receiving headers in Shibboleth/SAML

[Peter Schober]

Fackenthal, John (NIH/OD) [C] via users <users at shibboleth.net> [2024-08-02 22:40 CEST]:
> I’ve set up a Shibboleth/SAML SP on our development server. I’m able
> to authenticate through my Identity Provider and get a return to our
> Web application through Apache. However, when I look at the header
> values either in my SAML Chrome extension or on the application
> server, there’s nothing that I expect to see, such as Employee
> ID. I’ve asked the IDP how I can extract this information from the
> header or how to properly request it but they could only tell me to
> ask a question here.

1. Log files. See the SP's transaction log for successfully mapped
attributes which will be available from the software. Check the SP's
shibd.log for lines with "skipping", those are attributes sent by the
IDP you're not currently mapping (and which therefore are not yet
available).

You could also turn on debug logging (cf. The Fine Documentation for
that) but given the above information that shouldn't even be
necessary.
Debug logging for the right logging categories (e.g. the OpenSAML ones
in /etc/shibboleth/shibd.logger) will show you the complete SAML
Assertion with all attribute names and name formats, which you'd have
to add to your attribute map.


2. To see successfully mapped attributes from the browser (possiby
with their values, by default only with the number of values) you
could access the SP's Session handler after having established a local
session (which you will, even without any attributes being available),
which by default is available at /Shibboleth.sso/Session

You could combine this with the Login handler to get a new assertion
from the IDP and show the result in the Session handler in one go,
e.g. for testing your config after having made changes to your
attribute map:

  https://your.sp.example.org/Shibboleth.sso/Login?entityID=<IDP-ENTITYID>&target=https://your.sp.example.org/Shibboleth.sso/Session

replacing "<IDP-ENTITYID>" with your IDP's entityID, of course.
(If you're only federating with a single IDP and have set that IDP's
entityID in the SP's SSO config element you can drop the entityID
request parameter from the URL above.)

> Do I need to put some value in the attribute-map.xml file? I’ve
> guessed at a few simple things but of course that doesn’t work.

Your logs will tell you what you're mapping and what you're not
currently mapping.
If you have found that information and still can't get it to work feel
free to reply with more details.

-peter