Regarding Okta Shibboleth Integration Generates SAML Assertion with Data Manipulation

Fri Nov 15 14:11:11 UTC 2024

Vinay -

  This seems like a question you should be asking Okta.

  I am not aware of any form of String-Array datatype in the LDAP RFCs --
and the LDAP schema defines eduPersonAffiliation as Directory String (as
defined in RFC 4517, section 3.3.6
<https://www.rfc-editor.org/rfc/rfc4517.html#section-3.3.6>), which
explicitly allows any arbitrary character.

  You do not show how the OpenDJ server provided the response to a
comparable LDAP query, but I suspect that it looked like this:

eduPersonAffiliation affiliate
eduPersonAffiliation member

  If Okta is delivering multiple values on a single attribute label, it is
not surprising to me that you are getting unexpected results.

Steve.

On Fri, Nov 15, 2024 at 7:41 AM Bhruguwar, Vinay Mahendra via users <
users at shibboleth.net> wrote:

> Hi Team,
>
> We are working on a client engagement, where we have enabled SAML proxy
> for Shibboleth IDP and configure Okta as upstream IDP for SSO. We are
> following hybrid approach for fetching attributes from Okta’s LDAP
> interface. Previously the data used to be pulled from Open DJ LDAP which is
> now replaced with Okta LDAP.
>
> We have observed that due to differences in directories structure and Data
> Type between Open DJ & Okta LDAP because of which the multivalued
> attributes sent from Okta LDAP mapped to Shibboleth objects are getting
> manipulated, with open/close brackets [] & comma separated considering as
> single attribute in Shibboleth generated SAML assertion as shown in below
> logs
>
> *Shibboleth Generated SAML Assertion for Attribute from Open DJ LDAP:*
>
>
>
> <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"
> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>
> <saml2:AttributeValue xmlns:xsd=http://www.w3.org/2001/XMLSchema
> xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:type="xsd:string">
> member at ucsf.edu</saml2:AttributeValue>
> <member at ucsf.edu%3c/saml2:AttributeValue>
>
>   <saml2:AttributeValue xmlns:xsd=http://www.w3.org/2001/XMLSchema
> xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:type="xsd:string">
> affiliate at ucsf.edu</saml2:AttributeValue>
> <affiliate at ucsf.edu%3c/saml2:AttributeValue>
>
>    </saml2:Attribute>
>
> *Shibboleth Generated SAML Assertion for Attribute from Okta LDAP:*
>
>
>
> <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"
> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>
>                 <saml2:AttributeValue xmlns:xsd=
> http://www.w3.org/2001/XMLSchema xmlns:xsi=
> http://www.w3.org/2001/XMLSchema-instance xsi:type="xsd:string">[affiliate,
> member]@ucsf.edu</saml2:AttributeValue>
>
>
>
> *Attribute Value stored in Okta LDAP:*
>
> Okta LDAP is storing this attribute value in String-Array datatype but
> when this attributes are getting resolved at *eduPersonScopedAffiliation *attribute
> in Shibboleth, it manipulates the data as a comma separated single value &
> array values enclosed in [] brackets.
>
> *eduPersonScopedAffiliation* is scoped attribute in Shibboleth which is a
> domain-valued suffix, to an input attribute's values.
>
> We have attribute resolver in our Shibboleth configuration which resolves
> the above scoped attribute and please find below snippet section that
> handles the transformation for reference
>
> <AttributeDefinition id="eduPersonScopedAffiliation"
>         xsi:type="Scoped"
>         scope="ucsf.edu"
> >
> <InputDataConnector ref="oktaLDAP" attributeNames="edupersonaffiliation" />
> <DisplayName>Education Person Scoped Affiliation</DisplayName>
> <DisplayDescription>Your affiliation with UCSF in a special format used by
> some applications.</DisplayDescription>
> <AttributeEncoder xsi:type="SAML1ScopedString"
>             name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" />
> <AttributeEncoder xsi:type="SAML2ScopedString"
>             name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
> friendlyName="eduPersonScopedAffiliation" />
> </AttributeDefinition>
>
> *Our Shibboleth IDP version: V4.3.3*
>
> Kindly help us with the required configuration or changes needs to put in
> place, by which we can stores and maps the Incoming SAML multivalued
> attributes to Shibboleth attributes resolver as is without being altered as
> single value comma separated and enclosed in brackets. Also can you please
> help us with any reference that talks about Shibboleth user schema & its
> datatypes
>
>
> Please reach out to me or people in CC for any additional details.
>
> Best Regards,
> Vinay Bhruguwar
> Advisory - Senior Solution Advisor
> Cyber IAM | Deloitte US India Risk and Financial Advisory
>
> vbhruguwar at deloitte.com | www.deloitte.com
>
> Please consider the environment before printing.
>
>
>
>
>
>
>
> This message (including any attachments) contains confidential information
> intended for a specific individual and purpose, and is protected by law. If
> you are not the intended recipient, you should delete this message and any
> disclosure, copying, or distribution of this message, or the taking of any
> action based on it, by you is strictly prohibited.
>
> Deloitte refers to a Deloitte member firm, one of its related entities, or
> Deloitte Touche Tohmatsu Limited ("DTTL"). Each Deloitte member firm is a
> separate legal entity and a member of DTTL. DTTL does not provide services
> to clients. Please see www.deloitte.com/about to learn more.
>
> v.E.1
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241115/82763033/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 9532 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20241115/82763033/attachment.png>