Shibboleth v5.1.3 configuration issue with EntraID Shibboleth application proxy IdP getting claims but not transcoding to attributes

[Cantor, Scott]

> Do I need to merge the v4 and v5 guidance? 

The intended documentation for V5 for proxying with SAML is https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505973/SAMLAuthnConfiguration

The stuff you're talking about is about c14n, not attribute decoding. That is what changed and the V5 material is updated to reflect simpler options for that.

Attribute decoding is the same in both versions. You drop in transcoding rules and you need a filter policy set up for the INBOUND direction from the relevant issuer, same in both versions. You didn't get to the filter step yet since it hasn't managed to decode them.

Most likely you've ignored altering the NameFornat in the transcoding rules. We default that to the constant in SAML for URI naming and always have because that is the only one that should ever be used. Omitting the NameFormat or not using URIs is a bad practice and we want bad practice to be painful and not accidental.

We cover that in the page on SAML 2 transcoding, https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510658/SAML2AttributeTranscoderConfiguration, it's noted below the property reference table.

I thought MS' products generally did populate NameFormat properly, but your trace suggests otherwise.

-- Scott