Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[o haya]

 Hi Peter,

After some discussion, we want the NameID format to be emailAddress, and
for the source to be the "cn" attribute. Also "cn" values will be
emailAddress format.

I don't know if it matters but the "cn" attribute is the primary attribute
in the LDAP.

For now, we want the following attributes from the LDAP to be returned in
the response (the attribute names below are the attribute names in the LDAP
server):


   - emailAddress
   - givenName
   - sn


>From what I have read (and heard from the mailing list), it sounds like I
am going to have to modify the following files:

To enable/configure the attributes:

   - attribute-resolver.xml
   - attribute-filter.xml

To configure the NameID:

   - saml-nameid.properties


A couple of questions.


   - In the saml-nameid.properties, it has this:

"# Default NameID Formats to use when nothing else is called for.
> # Don't change these just to change the Format used for a single SP!
> #idp.nameid.saml2.default = F"


If the "idp.named.saml2.default" shouldn't be used to set NameID format,
where should it be set?

Also, is it correct/ok, to set the NameID format to
"urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"?


   - For the attribute-filter.xml, my interpretation was I needed to add
   something like what you had provided for that non-existent SP earlier, i.e.
   something like:


<AttributeFilterPolicy id="frontendSP">

  <PolicyRequirementRule xsi:type="Requester" value="
> https://saml.example.org" />    <<<== Should the "value" be the EntityID
> of the SP?
>   <AttributeRule attributeID="cn" permitAny="true" />
>   <AttributeRule attributeID="emailAddress" permitAny="true" />
>   <AttributeRule attributeID="givenName" permitAny="true" />
>   <AttributeRule attributeID="sn" permitAny="true" />
> </AttributeFilterPolicy>



For the attrribute-resolver.xml, I think that I need to add:

    <AttributeDefinition id="cn"">
>         <InputDataConnector ref="myLDAP" attributeNames="cn" />
>     </AttributeDefinition>

    <AttributeDefinition id="emailAddress">
        <InputDataConnector ref="myLDAP" attributeNames="emailAddress" />
<<== I am a little unclear about the names.  attribute in LDAP is
"emailAddress" and was wondering if we could change the name in the
response to "mail" instead?
    </AttributeDefinition>

    <AttributeDefinition id="givenName">
        <InputDataConnector ref="myLDAP" attributeNames="givenName" />
    </AttributeDefinition>

    <AttributeDefinition id="sn">
        <InputDataConnector ref="myLDAP" attributeNames="sn" />
    </AttributeDefinition>


I think that I also should to pare down the "exportAttributes"?  May be to:

exportAttributes="mail sn givenName cn">



Does that sound about right?

Thanks for ALL of your help (and patience!).

Jim


<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Thu, Apr 10, 2025 at 4:59 PM Peter Schober via users <
users at shibboleth.net> wrote:

> o haya via users <users at shibboleth.net> [2025-04-10 22:00 CEST]:
> > Does the above mean that the Shibboleth IdP currently can get the
> > "uid" attribute from the user in LDAP
>
> You have your config (attribute-resolver.xml). You can see where it
> comes from.
>
> > Also does that help for figuring out how to get the NameID to work?
>
> There's no such thing as "a/the NameID": There are different NameID
> Formats (and "unspecified" is not a format anyone can sanely require
> you to send).
> So the first question now is what specific NameID Format the other
> system (the other IDP's SP, IIRC) expects to recieve because you can't
> just send it "a NameID".
> The SAML 2.0 specification includes a few definitions (see section
> 8.3 in this document,
>
> https://groups.oasis-open.org/higherlogic/ws/public/download/56777/sstc-saml-core-errata-2.0-wd-07-diff.pdf
> )
> amd you have already seen "transient" NameIDs in your IDP.
> (If none of the standard-defined values match your use-case you can
> also send other formats. I'll not cover this here.)
>
> Once you know what NameID Format the SP needs you can decice what
> internal attribute in your Shibboleth IDP you want to create this
> NameID value from. Which in your case probably means amendng your
> attribute resolver conf to look up the required data from LDAP or
> elsehwere. Then you can proceed to configure a NameID in the
> approriate config files (conf/saml-nameid.*)
>
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250410/8ccbc89d/attachment.htm>