expose 'groups' claim from OIDC OP to rest of the system

[Philip Smart]

Dear all,

I am trying to setup shibboleth 5.13 using OIDC RP with Entra ID.   The setup could authenticate and expose some of the claims from Entra ID to SP without problem.

Now, I would like to expose the groups/roles claim from Entra ID but fail.

I've setup the following transcoding rule for roles claims:

        <bean parent="shibboleth.TranscodingProperties">
            <property name="properties">
                <props merge="true">
                    <prop key="id">roles</prop>
                    <prop key="transcoder">OIDCStringTranscoder</prop>
                    <prop key="oidc.name">roles</prop>
                    <prop key="oidc.asArray">true</prop>
                    <prop key="displayName.en">Roles</prop>
                    <prop key="description.en">Roles</prop>
                </props>
            </property>
        </bean>

attribute-resolver:

    <AttributeDefinition xsi:type="SubjectDerivedAttribute"
            id="roles"
            principalAttributeName="roles">
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:xxx..." friendlyName="roles" encodeType="false" />
    </AttributeDefinition>


Did you also release this using a suitable filter? (see https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#%5BinlineExtension%5DAttribute-Extraction-and-Filtering)



The sample roles claim as array:

Attribute '{"roles":["xxx-..."],["xxx-..."],["xxx-..."],["xxx-..."]}’


If this is the actual JSON string, I am not sure it is valid. I would expect it to be more like the following if it is an array of strings: '{"roles":["xxx-…","xxx-…","xxx-…","xxx-..."]}’

If your IdP is logging on TRACE, you should be able to see if the transcoder is decoding the ‘roles’ claim e.g. a logging line something like:

TRACE [net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder:207] - Beginning to decode claim ‘roles'

Can you see that?


Phil



Any idae?


Thanks


Chris



Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241112/0b7f1107/attachment.htm>