Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[o haya]

Peter,

Ahhh...

I set IDP_BASE_URL to http://localhost:8080/idp and ran the command for
users "test1" (exists in LDP) and "test10" (doesn't exist in LDAP) and got:

/opt/shibboleth-idp/bin/aacli.sh --saml2 -n test1 -r
https://saml.example.org
<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_1bbc6c891c71007cdb5fd632ef1e3163"
IssueInstant="2025-04-10T19:43:31.104Z" Version="2.0">
    <saml2:Issuer>https://idp01.xxxx.com/idp/shibboleth</saml2:Issuer>
    <saml2:Subject>
        <saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="
https://idp01.xxxx.com/idp/shibboleth" SPNameQualifier="
https://saml.example.org
">AAdzZWNyZXQxQvJPtSpTNtvrZPNHmm9gI9qdJRNRxK2tdkQ6mSiKxZjr8qf7Dpue+pEfSJ4/XerHfcdUJee5Q/rIWioBvPReiOkNsgeJPCH7VgbuNlM78xgp0yO9ecTmnID577M=</saml2:NameID>
    </saml2:Subject>
    <saml2:AttributeStatement>
        <saml2:Attribute FriendlyName="uid"
Name="urn:oid:0.9.2342.19200300.100.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>test1</saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute FriendlyName="eduPersonPrincipalName"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue>test1 at xxxx.com</saml2:AttributeValue>
        </saml2:Attribute>
    </saml2:AttributeStatement>
</saml2:Assertion>


/opt/shibboleth-idp/bin/aacli.sh --saml2 -n test10 -r
https://saml.example.org
<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_77770fa5315324f5b79db966d3dea15b"
IssueInstant="2025-04-10T19:43:51.848Z" Version="2.0">
    <saml2:Subject>
        <saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="
https://idp01.xxxx.com/idp/shibboleth" SPNameQualifier="
https://saml.example.org
">AAdzZWNyZXQxxf5ws6L3aXM77p4q8HSE+SJPQIm1p2nR5MjZMk1Ps8hkflGgVX90xK6F75DsVZemUK23WlB2ZuqCtZ80d1jyyo6lLj/De0aEfvbFcPDB+tvU2m0rL1++s+dihEDs</saml2:NameID>
    </saml2:Subject>
</saml2:Assertion>


Does the above mean that the Shibboleth IdP currently can get the "uid"
attribute from the user in LDAP (which we probably do use), and not the
"eduPersonPrincipalName" attribute (from the value it looks like that might
actually be the emailAddress attribute in the LDAP?) ?

Also does that help for figuring out how to get the NameID to work?

THANKS!!

Jim

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Thu, Apr 10, 2025 at 3:00 PM Peter Schober via users <
users at shibboleth.net> wrote:

> o haya via users <users at shibboleth.net> [2025-04-10 20:03 CEST]:
> > Actually, I decided to try what you suggested with the small metadata,
> > etc., and, when I tested it, the aacli command line didn't work because
> of
> > the port problem, but I tried to use a curl command with the URL
> > [...]
> > Connection refused
>
> https://shibboleth.net/pipermail/users/2025-April/056331.html
> w/ correction here:
> https://shibboleth.net/pipermail/users/2025-April/056332.html
>
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250410/703dd0d4/attachment.htm>