Trying to release new attribute funetEduPersonLearnerId
Scott Alexander
scott.alexander at humak.fi
Thu Jan 30 10:21:49 UTC 2025
Hi,
I cloned our IDP server turned on debug
did a
/opt/shibboleth-identity-provider/bin/aacli.sh --configDir=conf/ --principal=test -r https://www.entity_id.com | grep StringAttributeValue
"StringAttributeValue{value=urn:schac:homeOrganizationType:fi:polytechnic}"
"StringAttributeValue{value=email_address at humak.fi}"
"StringAttributeValue{value=https://refeds.org/assurance}",
"StringAttributeValue{value=https://refeds.org/assurance/ATP/ePA-1m}",
"StringAttributeValue{value=https://refeds.org/assurance/IAP/medium}",
"StringAttributeValue{value=https://refeds.org/assurance/profile/cappuccino}",
"StringAttributeValue{value=https://refeds.org/assurance/IAP/low}",
"StringAttributeValue{value=https://refeds.org/assurance/ID/eppn-unique-no-reassign}"
"StringAttributeValue{value=surname}"
"StringAttributeValue{value=Anna-Maria}"
"StringAttributeValue{value=FACULTY}",
"StringAttributeValue{value=EMPLOYEE}",
"StringAttributeValue{value=STAFF}",
"StringAttributeValue{value=MEMBER}"
"ScopedStringAttributeValue{value=user_id, scope=humak.fi}"
"StringAttributeValue{value=name}"
"StringAttributeValue{value=humak.fi}"
"StringAttributeValue{value=name}"
"StringAttributeValue{value=https://rap.humak.fi/idp/profile/Logout}"
And see in logs anything associated with funetEduPersonLearnerId in it and see
grep funetEduPersonLearnerId idp-process.log
2025-01-29 17:01:03,551 - DEBUG [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:64] - Parsing configuration for AttributeDefinition plugin with id: id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId
2025-01-29 17:01:04,817 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:648] - Attribute Resolver 'ShibbolethAttributeResolver': Checking if attribute definition 'id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId' has a circular dependency
2025-01-29 17:01:04,908 - DEBUG [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:64] - Parsing configuration for AttributeDefinition plugin with id: id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId
2025-01-29 17:01:05,208 - DEBUG [net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl:290] - Attribute mapping: id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId <-> SAML1:{urn:mace:shibboleth:1.0:attributeNamespace:uri}urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId via SAML1StringAttributeTranscoder
2025-01-29 17:01:05,208 - DEBUG [net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl:290] - Attribute mapping: id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId <-> SAML2:{urn:oasis:names:tc:SAML:2.0:attrname-format:uri}urn:oid:1.3.6.1.4.1.16161.1.1.27 via SAML2StringAttributeTranscoder
2025-01-29 17:02:34,084 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:250] - Attribute Resolver 'ShibbolethAttributeResolver': Attempting to resolve the following attribute definitions [id-urn:mace:terena.org:schac:attribute-def:schacHomeOrganization, humakFunetEduPersonEPPNTimeStamp, id-urn:mace:funet.fi:attribute-def:funetEduPersonStudentCategory, id-urn:mace:terena.org:schac:attribute-def:schacPersonalUniqueID, id-urn:mace:funet.fi:haka:logout-url, id-urn:mace:dir:attribute-def:eduPersonAssurance, id-urn:mace:dir:attribute-def:telephoneNumber, id-urn:mace:dir:attribute-def:homePostalAddress, id-urn:mace:dir:attribute-def:displayName, id-urn:mace:dir:attribute-def:mobile, id-urn:mace:funet.fi:attribute-def:funetEduPersonProgram, id-urn:mace:dir:attribute-def:l, id-urn:mace:dir:attribute-def:eduPersonOrgDN, id-urn:mace:dir:attribute-def:o, id-urn:mace:dir:attribute-def:employeeNumber, id-urn:mace:dir:attribute-def:postalCode, id-urn:mace:dir:attribute-def:eduPersonScopedAffiliation, id-urn:mace:dir:attribute-def:mail, id-urn:mace:terena.org:schac:attribute-def:schacMotherTongue, id-urn:mace:terena.org:schac:attribute-def:schacDateOfBirth, id-urn:mace:dir:attribute-def:eduPersonEntitlement, id-urn:mace:funet.fi:attribute-def:funetEduPersonECTS, id-urn:mace:dir:attribute-def:sn, id-urn:mace:dir:attribute-def:eduPersonTargetedID, id-urn:mace:dir:attribute-def:eduPersonPrincipalName, nameidattr, id-urn:mace:funet.fi:attribute-def:funetEduPersonHomeCity, id-urn:mace:dir:attribute-def:eduPersonOrgUnitDN, id-urn:mace:dir:attribute-def:eduPersonPrimaryOrgUnitDN, id-urn:mace:dir:attribute-def:ou, id-urn:mace:dir:attribute-def:cn, id-urn:mace:terena.org:schac:attribute-def:schacUserStatus, id-urn:mace:funet.fi:attribute-def:funetEduPersonTargetDegree, id-urn:mace:funet.fi:attribute-def:funetEduPersonCreditUnits, urn:mace:dir:attribute-def:eduPersonTargetedID.old, id-urn:mace:funet.fi:attribute-def:funetEduPersonSpecialisation, id-urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation, id-urn:mace:dir:attribute-def:street, id-urn:mace:terena.org:schac:attribute-def:schacCountryOfResidence, id-urn:mace:funet.fi:attribute-def:funetEduPersonStudyToEnd, id-urn:mace:dir:attribute-def:postalAddress, id-urn:mace:terena.org:schac:attribute-def:schacGender, id-urn:mace:terena.org:schac:attribute-def:schacCountryOfCitizenship, id-urn:mace:dir:attribute-def:title, id-urn:mace:terena.org:schac:attribute-def:schacUserPresenceID, id-urn:mace:terena.org:schac:attribute-def:schacPersonalUniqueCode, humakDisplayName, id-urn:mace:funet.fi:attribute-def:funetEduPersonPrimaryStudyToEnd, id-urn:mace:dir:attribute-def:eduPersonAffiliation, id-urn:mace:funet.fi:attribute-def:funetEduPersonStudentUnion, id-urn:mace:dir:attribute-def:eduPersonNickname, id-urn:mace:terena.org:schac:attribute-def:schacHomeOrganizationType, id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId, id-urn:mace:dir:attribute-def:preferredLanguage, id-urn:mace:funet.fi:attribute-def:funetEduPersonStudentStatus, id-urn:mace:terena.org:schac:attribute-def:schacPlaceOfBirth, id-urn:mace:dir:attribute-def:postOfficeBox, id-urn:mace:funet.fi:attribute-def:funetEduPersonStudyStart, id-urn:mace:dir:attribute-def:homePhone, id-urn:mace:dir:attribute-def:givenName, id-urn:mace:funet.fi:attribute-def:funetEduPersonEPPNTimeStamp, id-urn:mace:dir:attribute-def:uid, id-urn:mace:funet.fi:attribute-def:funetEduPersonPrimaryStudyStart]
2025-01-29 17:02:34,831 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:431] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId'
2025-01-29 17:02:34,831 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId'
2025-01-29 17:02:34,831 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:137] - Attribute Definition 'id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId': produced an attribute with no values
2025-01-29 17:02:34,831 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:335] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId' produced an attribute with 0 values
2025-01-29 17:02:34,866 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:451] - Attribute Resolver 'ShibbolethAttributeResolver': De-duping (and null filtering) attribute definition id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId result
2025-01-29 17:02:34,866 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:513] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute definition 'id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId', contains no values
The DataConnector is a on-prem AD which has values for OID or funetEduPersonLearnerId
In attribute-resolver.xml
<AttributeDefinition id="id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId" xsi:type="Simple">
<InputDataConnector ref="AD1" attributeNames="funetEduPersonLearnerId" />
<DisplayName xml:lang="fi">funetEduPersonLearnerId</DisplayName>
<DisplayName xml:lang="en">funetEduPersonLearnerId</DisplayName>
<DisplayDescription xml:lang="fi">funetEduPersonLearnerId</DisplayDescription>
<DisplayDescription xml:lang="en">funetEduPersonLearnerId</DisplayDescription>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId" />
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.16161.1.1.27" friendlyName="funetEduPersonLearnerId" />
</AttributeDefinition>
in attribute-filter.xml
<AttributeRule attributeID="id-urn:mace:funet.fi:attribute-def:funetEduPersonLearnerId">
<PermitValueRule xsi:type="AttributeInMetadata" onlyIfRequired="false"/>
</AttributeRule>
Any idea what could be wrong?
Also using
ldapsearch -b "DC=humak,DC=local" -H "ldaps://ad" -x -w PASSWD -D "CN= xxxxxxx,OU=Staff,OU=Users,OU=Helsingin TKI-keskus (Ilkka),DC=humak,DC=local" "(sAMAccountName=lintan01)" cn mail uid funetEduPersonLearnerId
I search for known attributes using the exact same spelling I have set in the resolver and attribute files. (checking for a typo)
ldapsearch returns a value which is the correct value
Terveisin/Regards
Scott Alexander
Asiantuntija, järjestelmät Systems Specialist
Humak
Humanistinen ammattikorkeakoulu
University of Applied Sciences
www.humak.fi<http://www.humak.fi/>
Tel. +358 (0)50 411 9556
scott.alexander at humak.fi<mailto:scott.alexander at humak.fi>
________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250130/2b51ceb6/attachment.htm>
More information about the users
mailing list