Shibboleth v5.1.3 configuration issue with EntraID Shibboleth application proxy IdP getting claims but not transcoding to attributes

[Eric Yurick]

I've followed SAML Proxying EntraID / Azure with the Shibboleth IdP - Shibboleth Knowledge Base - Confluence<https://shibboleth.atlassian.net/wiki/spaces/KB/pages/2783936889/SAML+Proxying+EntraID+Azure+with+the+Shibboleth+IdP> which is for IdP v5 and up, but previously I was using the guidance from Using SAML Proxying in the V4 Shibboleth IdP to connect with Azure AD - Shibboleth Knowledge Base - Confluence<https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1467056889/Using+SAML+Proxying+in+the+V4+Shibboleth+IdP+to+connect+with+Azure+AD> and was having difficulties getting the Entra claims to be transposed to Shibboleth attributes.  The v4 documentation details the "joining" and the canonicalNameToUseForJoin in the attribute-resolver.xml and in c14n/attribute-sourced-subject-c14n-config.xml, but the v5 guidance doesn't touch on a canonicalNameToUserForJoin.  Is this handled elsewhere in v5 or was it missed in the guidance?

I see the claims from Entra, but
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                <AttributeValue>e*****@g*****.edu</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                <AttributeValue>e*****@g*****.edu</AttributeValue>
            </Attribute>

but I get

INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:539] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:539] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')

Do I need to merge the v4 and v5 guidance?

Thank you for your help in advance.
==================================
Eric Yurick
Internet Specialist
Gettysburg College
eyurick at gettysburg.edu<mailto:eyurick at gettysburg.edu>
717-337-6888


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241217/9857013f/attachment.htm>