saml proxying shib to ADFS - No transcoding rule for Attribute
Ramaiah, Vanna G.
ramaiah at musc.edu
Thu Feb 13 22:38:39 UTC 2025
I am following this article to set up proxt to adfs.
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1467056889/Using+SAML+Proxying+in+the+V4+Shibboleth+IdP+to+connect+with+Azure+AD
>From debug logs, I can confirm that adfs is passing the attributes to shib. Attribute filter.xml and attribute-resolver.xml are setup. azureClaims.xml is included in conf/attributes/default-rules.xml.
I see the below logs.
DEBUG [org.opensaml.saml.saml2.assertion.SAML20AssertionValidator:876] - Assertion contains at least 1 SubjectConfirmation, proceeding with subject confirmation
INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:482] - Profile Action ValidateSAMLAuthentication: Incoming SAML Attributes mapped to attribute IDs: []
Profile Action ValidateSAMLAuthentication: SAML authentication succeeded for 'null'
Here is sample of azureClaims. I turned off scope.
<property name="properties">
<props merge="true">
<prop key="id">azureName</prop>
<prop key="transcoder">SAML2StringTranscoder</prop>
<prop key="saml2.name">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name</prop<http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name%3c/prop>>
<prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified</prop>
<prop key="displayName.en">Name</prop>
<prop key="description.en">Azure UPN of an account expected to be scoped thus transcoded that way</prop>
</props>
</property>
What am I missing?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250213/e5dc94a0/attachment.htm>
More information about the users
mailing list