Attribute Release Not Working

Michael B Allen ioplex at gmail.com
Sat Jul 12 14:18:29 UTC 2025 

On Fri, Jul 11, 2025 at 10:39 PM IAM David Bantz via users <
users at shibboleth.net> wrote:

> I did not look in great detail, but I do not see an attribute-filter rule
> (release policy) for http://sp.techi.wan:8080/login/saml2/sso/techcorp
>
> Look at the sample in the file you copied:
>  <AttributeFilterPolicy id="example1">
>         <PolicyRequirementRule xsi:type="Requester" value="
> https://sp.example.org" />
>
>         <AttributeRule attributeID="uid" permitAny="true" />
>     </AttributeFilterPolicy>
>
> That releases "uid" to https://sp.example.org
>
> You can build something parallel.  Yes there are lots of more clever
> versions of attribute policy rules, but you might try that bottom rung
> level first.
>
> Of course, you should also turn up the logging level for idp-process.log
> which can tell you in painful detail of every step along the way.
>

That's just one of the examples from the default config that I would think
should be ignored.

You can see sAMAccountName is released at the top of attribute-filter.xml.

I have removed all of the examples so that attribute-filter.xml is just:

<?xml version="1.0" encoding="UTF-8"?>
<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
        xmlns="urn:mace:shibboleth:2.0:afp"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp
http://shibboleth.net/schema/idp/shibboleth-afp.xsd">

    <AttributeFilterPolicy id="alwaysRelease">
        <PolicyRequirementRule xsi:type="ANY" />
        <AttributeRule attributeID="sAMAccountName" permitAny="true" />
    </AttributeFilterPolicy>

</AttributeFilterPolicyGroup>

I removed default-rules.xml from services.xml and commented out the one
bean in attribute-registry.xml since there are no applicable files in
attributes/custom.

So I think this should simplify things.

I increased logging in conf/idp.properties:

idp.loglevel.root: DEBUG

Then I did:

$ bin/build.sh

started a capture, started Jetty, authenticated.
I see the KRB5 auth followed immediately by a successful LDAP query.
However, there is nothing in the logs about attributes or releasing
anything (other than PropertyDrivenModule loading files like
attribute-filter.xml):

INFO [net.shibboleth.idp.authn.impl.KerberosCredentialValidator:201] -
Credential Validator krb5: Login by 'dev at TECH.CORP' succeeded
INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:201] - Profile
Action FinalizeAuthentication: Principal dev at TECH.CORP authenticated
DEBUG [org.apache.velocity.loader:442] - ResourceManager: found
084fa3ca-04d0-4151-8dde-dcf4279b7002 with loader
org.apache.velocity.runtime.resource.loader.StringResourceLoader
DEBUG [org.opensaml.core.xml.util.XMLObjectSupport:273] - Marshalling
XMLObject
DEBUG [org.opensaml.storage.AbstractMapBackedStorageService:347] - Read
failed, key
'AAdzZWNyZXQx/acpQsJuXNINNV8f9BWyHJF6iyevX9UOh+71Obrz2SxjA2AST9vF58CJr/8ZNJXgeAW8RsHrxOj10ZSByU8Ox/Rao0Zpput7HNqlO0USltVi0Ym3aEHVnBr6LsyPyC0zN+1uJtOthOTzvw8vNqw6fGQN9/Z4vit5xEaoGghAkfIaSteOuD+3QJUuskXXtgmR'
not found in context '
http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp'
DEBUG
[org.opensaml.storage.impl.client.PopulateClientStorageSaveContext:111] -
Profile Action PopulateClientStorageSaveContext: ClientStorageServices
requiring save: [shibboleth.ClientSessionStorageService]
DEBUG [org.apache.velocity.loader:442] - ResourceManager: found
/client-storage/client-storage-write.vm with loader
org.apache.velocity.runtime.resource.loader.FileResourceLoader
DEBUG [org.apache.velocity.loader:442] - ResourceManager: found
client-storage/local-storage-write.js with loader
net.shibboleth.shared.spring.velocity.SpringResourceLoader
DEBUG [org.apache.velocity.loader:442] - ResourceManager: found
client-storage/write.vm with loader
net.shibboleth.shared.spring.velocity.SpringResourceLoader
DEBUG [org.opensaml.storage.impl.client.LogLocalStorageSaveResults:79] -
Profile Action LogLocalStorageSaveResults: Save to local storage for
StorageService 'shibboleth.ClientSessionStorageService' succeeded
DEBUG
[org.opensaml.storage.impl.client.SaveCookieBackedClientStorageServices:108]
- Profile Action SaveCookieBackedClientStorageServices: No cookie
operations required
DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message
Handler:  Activation condition for handler returned true
DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message
Handler:  Activation condition for handler returned true
DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message
Handler:  Activation condition for handler returned true
DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message
Handler:  Activation condition for handler returned true
DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message
Handler:  Activation condition for handler returned true
DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:103] -
Starting to marshall {http://www.w3.org/2000/09/xmldsig#}Signature
DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:111] -
Creating XMLSignature object
DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:120] - Adding
content to XMLSignature.
DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:125] -
Creating Signature DOM element
DEBUG [org.opensaml.xmlsec.signature.support.Signer:76] - Using a signer of
implemenation:
org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl

DEBUG
[org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl:63]
- Computing signature over XMLSignature object
DEBUG [org.opensaml.profile.action.impl.EncodeMessage:130] - Profile Action
EncodeMessage: Encoding outbound response using message encoder of type
org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder for this
response
DEBUG [org.opensaml.profile.action.impl.EncodeMessage:134] - Profile Action
EncodeMessage: Encoder was not initialized, injecting MessageContext and
initializing
DEBUG
[org.opensaml.messaging.encoder.servlet.BaseHttpServletResponseXMLMessageEncoder:50]
- Beginning encode of message of type:
org.opensaml.saml.saml2.core.impl.ResponseImpl
DEBUG
[org.opensaml.messaging.encoder.servlet.BaseHttpServletResponseXMLMessageEncoder:86]
- Marshalling message
DEBUG [org.opensaml.core.xml.util.XMLObjectSupport:273] - Marshalling
XMLObject

In conf/ldap.properties I have:

idp.attribute.resolver.LDAP.searchFilter =
(userPrincipalName=$resolutionContext.principal)

which I can see being used and gets all properties including sAMAccountName.

In conf/attribute-resolver.xml I have:

DataConnector ... exportAttributes="sAMAccountName mail displayName sn
giv...">

Is there more to the linkage between LDAP and attribute release than this?

Could excludeResolutionPhases="c14n/attribute" be blocking something?

Is there something else I can do to just see attribute resolution working
at all?

Where in the source code should I look given the above point-of-failure?

Mike

-- 
Michael B Allen
Java AD DS Integration
https://www.ioplex.com/ <http://www.ioplex.com/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250712/b61971a3/attachment.htm>

More information about the users mailing list