expose 'groups' claim from OIDC OP to rest of the system

[Chris Leung YW]

Dear all,

I am trying to setup shibboleth 5.13 using OIDC RP with Entra ID.   The setup could authenticate and expose some of the claims from Entra ID to SP without problem.

Now, I would like to expose the groups/roles claim from Entra ID but fail.

I've setup the following transcoding rule for roles claims:

        <bean parent="shibboleth.TranscodingProperties">
            <property name="properties">
                <props merge="true">
                    <prop key="id">roles</prop>
                    <prop key="transcoder">OIDCStringTranscoder</prop>
                    <prop key="oidc.name">roles</prop>
                    <prop key="oidc.asArray">true</prop>
                    <prop key="displayName.en">Roles</prop>
                    <prop key="description.en">Roles</prop>
                </props>
            </property>
        </bean>

attribute-resolver:

    <AttributeDefinition xsi:type="SubjectDerivedAttribute"
            id="roles"
            principalAttributeName="roles">
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:xxx..." friendlyName="roles" encodeType="false" />
    </AttributeDefinition>


The sample roles claim as array:

Attribute '{"roles":["xxx-..."],["xxx-..."],["xxx-..."],["xxx-..."]}'


Any idae?


Thanks


Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241111/1ca96244/attachment.htm>