Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Cantor, Scott]

> [WARNING: LONGISH post !]

Dumping reams of XML and hoping somebody is willing to help you for free...do not mix. You think you're helping by providing context, but there's a balance. Just my advice.

> So I am wondering if anyone might have any suggestions
> about why the mail/emailAddress isn't being returned in the
> SAMLResponse when the aacli command is run?

Attributes in the IdP are tagged with an internal ID string that names them, independent of their source or eventual naming in any protocol message. Filtering rules are based on that ID. Attribute definitions are literally naming them that way. Exported data connector attributes are implicit attribute definitions.

Using "mail" is by convention and matches the standard inetOrgPerson definition of the attribute type in LDAP and is mapped to the standard name for it in SAML to allow it to be handled withoout extra work by people who choose to follow the standard.

Your LDAP search proves the LDAP server calls it "mail", as they all do, that's baked into the earliest RFCs. Nothing else you're seeing is relevant.

Have the LDAP query return "mail", use the ID of "mail" in the IdP, release "mail" in the filter policy, and you're done.

-- Scott