Shibboleth SP not downloading SAML assertion with namespace

[Kannan, Satheesh (ELS-CON)]

We are receiving below  error in the log file

5:08:45.142(08/18) WARN  Shibboleth.AttributeDecoder.Scoped : ignoring unscoped AttributeValue
05:08:45.142(08/18) INFO  Shibboleth.AttributeExtractor.XML : skipping SAML 2.0 Attribute with Name: urn:oasis:names:tc:SAML:attribute:pairwise-id


ScopedAttribute decoder wouldn't able to capture the unscoped value

<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/> - treats SAML attribute values as string

Can we have one decoder supports

Download attribute  value without scope when attribute value (test at idp.com)
Download entire string without contains scope value. Say for example "abctshsj"

Would that be possible

Do we have to support multiple mapping rules rather than supporting one mapping rule

Regards,
Satheesh

________________________________
From: Kannan, Satheesh (ELS-CON) <s.kannan.1 at elsevier.com>
Sent: Monday, August 18, 2025 12:10 PM
To: Kannan, Satheesh (ELS-CON) <s.kannan.1 at elsevier.com>
Subject: Re: Shibboleth SP not downloading SAML assertion with namespace

We are receiving below  error in the log file

5:08:45.142(08/18) WARN  Shibboleth.AttributeDecoder.Scoped : ignoring unscoped AttributeValue
05:08:45.142(08/18) INFO  Shibboleth.AttributeExtractor.XML : skipping SAML 2.0 Attribute with Name: urn:oasis:names:tc:SAML:attribute:pairwise-id


ScopedAttribute decoder wouldn't able to capture the unscoped value

<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/> - treats SAML attribute values as string

Can we have one decoder supports

Download attribute  value without scope when attribute value (test at idp.com)
Download entire string without contains scope value. Say for example "abctshsj"

Would that be possible

Do we have to support multiple mapping rules rather than supporting one mapping rule

Regards,
Satheesh


________________________________
From: Kannan, Satheesh (ELS-CON) <s.kannan.1 at elsevier.com>
Sent: Monday, August 18, 2025 11:20 AM
To: Shib Users <users at shibboleth.net>
Cc: Yaganti, Kiranmai (ELS-CON) <k.yaganti at elsevier.com>
Subject: Shibboleth SP not downloading SAML assertion with namespace

Dear Shibboleth Community,

We are encountering an issue with one of our Identity Providers (IdP) that is releasing a pseudonymous attribute using a namespace declaration in the SAML response. Specifically, the attribute is structured as follows:


<saml2:AttributeValue xmlns:xsd="XML Schema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">


Our Service Provider (SP) is unable to parse or download this attribute correctly. However, when the namespace uses `xs` instead of `xsd`, like below, the attribute is processed without any issues:


<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">


We would appreciate your insights on the following:
- Is the use of `xsd` as a namespace prefix instead of `xs` causing the issue?
- Is this a known compatibility problem with certain SP implementations?
- What would be the recommended approach to resolve this?

Thank you in advance for your guidance and support.

Regards,
Satheesh


________________________________

Elsevier B.V. Registered Office: Radarweg 29, 1043 NX Amsterdam, The Netherlands, Registration No. 33158992, Registered in The Netherlands.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250818/6aea6a7a/attachment.htm>