Regarding Okta Shibboleth Integration Generates SAML Assertion with Data Manipulation

[Bhruguwar, Vinay Mahendra]

Hi Team,

We are working on a client engagement, where we have enabled SAML proxy for Shibboleth IDP and configure Okta as upstream IDP for SSO. We are following hybrid approach for fetching attributes from Okta's LDAP interface. Previously the data used to be pulled from Open DJ LDAP which is now replaced with Okta LDAP.
We have observed that due to differences in directories structure and Data Type between Open DJ & Okta LDAP because of which the multivalued attributes sent from Okta LDAP mapped to Shibboleth objects are getting manipulated, with open/close brackets [] & comma separated considering as single attribute in Shibboleth generated SAML assertion as shown in below logs
Shibboleth Generated SAML Assertion for Attribute from Open DJ LDAP:

<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:type="xsd:string">member at ucsf.edu</saml2:AttributeValue><mailto:member at ucsf.edu%3c/saml2:AttributeValue>
  <saml2:AttributeValue xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:type="xsd:string">affiliate at ucsf.edu</saml2:AttributeValue><mailto:affiliate at ucsf.edu%3c/saml2:AttributeValue>
   </saml2:Attribute>
Shibboleth Generated SAML Assertion for Attribute from Okta LDAP:

<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                <saml2:AttributeValue xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:type="xsd:string">[affiliate, member]@ucsf.edu</saml2:AttributeValue>

Attribute Value stored in Okta LDAP:
[cid:image001.png at 01DB3789.D15D6E10]
Okta LDAP is storing this attribute value in String-Array datatype but when this attributes are getting resolved at eduPersonScopedAffiliation attribute in Shibboleth, it manipulates the data as a comma separated single value & array values enclosed in [] brackets.
eduPersonScopedAffiliation is scoped attribute in Shibboleth which is a domain-valued suffix, to an input attribute's values.
We have attribute resolver in our Shibboleth configuration which resolves the above scoped attribute and please find below snippet section that handles the transformation for reference
<AttributeDefinition id="eduPersonScopedAffiliation"
        xsi:type="Scoped"
        scope="ucsf.edu"
>
<InputDataConnector ref="oktaLDAP" attributeNames="edupersonaffiliation" />
<DisplayName>Education Person Scoped Affiliation</DisplayName>
<DisplayDescription>Your affiliation with UCSF in a special format used by some applications.</DisplayDescription>
<AttributeEncoder xsi:type="SAML1ScopedString"
            name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" />
<AttributeEncoder xsi:type="SAML2ScopedString"
            name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation" />
</AttributeDefinition>
Our Shibboleth IDP version: V4.3.3
Kindly help us with the required configuration or changes needs to put in place, by which we can stores and maps the Incoming SAML multivalued attributes to Shibboleth attributes resolver as is without being altered as single value comma separated and enclosed in brackets. Also can you please help us with any reference that talks about Shibboleth user schema & its datatypes

Please reach out to me or people in CC for any additional details.
Best Regards,
Vinay Bhruguwar
Advisory - Senior Solution Advisor
Cyber IAM | Deloitte US India Risk and Financial Advisory
vbhruguwar at deloitte.com<mailto:vbhruguwar at deloitte.com> | www.deloitte.com<http://www.deloitte.com/>
Please consider the environment before printing.




This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

Deloitte refers to a Deloitte member firm, one of its related entities, or Deloitte Touche Tohmatsu Limited ("DTTL"). Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

v.E.1
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241115/f3897b59/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 9532 bytes
Desc: image001.png
URL: <http://shibboleth.net/pipermail/users/attachments/20241115/f3897b59/attachment.png>