saml proxying shib to ADFS - No transcoding rule for Attribute

[Ramaiah, Vanna G.]

Forgot to attach attribute filter

<AttributeFilterPolicy id="FilterPolicyObject-Proxy-FromAzure-byIssuer-Type">
    <PolicyRequirementRule xsi:type="Issuer" value= *** />

    <AttributeRule attributeID="azureDisplayname" permitAny="true" />
    <AttributeRule attributeID="azureGivenname" permitAny="true" />
    <AttributeRule attributeID="azureSurname" permitAny="true" />
    <AttributeRule attributeID="azureAuthnmethodsreferences" permitAny="true" />
    <AttributeRule attributeID="azureIdentityprovider" permitAny="true" />
    <AttributeRule attributeID="azureTenantid" permitAny="true" />
    <AttributeRule attributeID="azureEmailaddress" permitAny="true" />
    <AttributeRule attributeID="azureObjectidentifier" permitAny="true" />
    <AttributeRule attributeID="azureName" permitAny="true" />

</AttributeFilterPolicy>

From: Ramaiah, Vanna G.
Sent: Thursday, February 13, 2025 5:39 PM
To: users at shibboleth.net
Subject: saml proxying shib to ADFS - No transcoding rule for Attribute

I am following this article to set up proxt to adfs.
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1467056889/Using+SAML+Proxying+in+the+V4+Shibboleth+IdP+to+connect+with+Azure+AD
>From debug logs, I can confirm that adfs is passing the attributes to shib. Attribute filter.xml and attribute-resolver.xml are setup.  azureClaims.xml is included in conf/attributes/default-rules.xml.

I see the below logs.

DEBUG [org.opensaml.saml.saml2.assertion.SAML20AssertionValidator:876] - Assertion contains at least 1 SubjectConfirmation, proceeding with subject confirmation
INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:482] - Profile Action ValidateSAMLAuthentication: Incoming SAML Attributes mapped to attribute IDs: []
Profile Action ValidateSAMLAuthentication: SAML authentication succeeded for 'null'

Here is sample of azureClaims. I turned off scope.
<property name="properties">
                <props merge="true">
                    <prop key="id">azureName</prop>
                    <prop key="transcoder">SAML2StringTranscoder</prop>
                    <prop key="saml2.name">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name</prop<http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name%3c/prop>>
                    <prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified</prop>
                    <prop key="displayName.en">Name</prop>
                    <prop key="description.en">Azure UPN of an account expected to be scoped thus transcoded that way</prop>
                </props>
            </property>

What am I missing?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250213/4ff5ed0e/attachment.htm>