saml proxying with azure ad - No transcoding rule for Attribute

[Ramaiah, Vanna G.]

I found what the issue is. Scott mentioned that initial load would tell what rules are getting registered.

Services.xml was missing a bean. Once I added it and restarted the service, it worked.

<util:list id ="shibboleth.AttributeRegistryResources">
<value>%{idp.home}/conf/attribute-registry.xml</value>
<value>%{idp.home}/conf/attributes/default-rules.xml</value>
</util:list>

From: Ramaiah, Vanna G.
Sent: Friday, March 14, 2025 1:45 PM
To: users at shibboleth.net
Subject: saml proxying with azure ad - No transcoding rule for Attribute

idp is not recognizing Azure AD claims. saml messages are decoded. It seems like azureClaims is not getting read.

1. Added new attribute mapping file azureClaims.xml in attributes folder
2. Added <import resource="azureClaims.xml" /> in default-rules.xml
3. attribute resolver has dataconnector and a attribute definition - SubjectDerivedAttribute for Canonicalization
4. The same attribute is added to attribute-sourced-subject-c14n-config

Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
Profile Action ValidateSAMLAuthentication: Incoming SAML Attributes mapped to attribute IDs: []


Interestingly, I see Profile Action ValidateSAMLAuthentication: SAML authentication succeeded for 'xyz'.


Sample Attribute resolver:
    <AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="true"    id="canonicaljoin" principalAttributeName="uid" />
   <AttributeDefinition xsi:type="SubjectDerivedAttribute" forCanonicalization="false"    id="mail"   principalAttributeName="azureEmailaddress" />
   <AttributeDefinition xsi:type="SubjectDerivedAttribute"    id="eduPersonPrincipalName"   principalAttributeName="azureName" />
     <DataConnector id="passthroughAttributes" xsi:type="Subject"
   exportAttributes="uid azureName azureEmailaddress azureTenantid azureObjectidentifier azureIdentityprovider azureAuthnmethodsreferences">
  </DataConnector>

Sample attribte-filter.xml

<AttributeFilterPolicy id="FilterPolicyObject-Proxy-FromAzure-byIssuer-Type">
    <PolicyRequirementRule xsi:type="Issuer" value=https://sts.windows.net/zzz/ />

    <AttributeRule attributeID="azureDisplayname" permitAny="true" />
    <AttributeRule attributeID="azureGivenname" permitAny="true" />
    <AttributeRule attributeID="azureSurname" permitAny="true" />
    <AttributeRule attributeID="azureAuthnmethodsreferences" permitAny="true" />
    <AttributeRule attributeID="azureIdentityprovider" permitAny="true" />
    <AttributeRule attributeID="azureTenantid" permitAny="true" />
    <AttributeRule attributeID="azureEmailaddress" permitAny="true" />
    <AttributeRule attributeID="azureObjectidentifier" permitAny="true" />
    <AttributeRule attributeID="azureName" permitAny="true" />
    <AttributeRule attributeID="uid" permitAny="true" />
</AttributeFilterPolicy>

    <AttributeFilterPolicy id="SendAccountName">
        <PolicyRequirementRule xsi:type="OR">  <Rule xsi:type="Requester" value=https://sp.example.org />   <Rule xsi:type="Requester" value=https://sp1.example.org />
        </PolicyRequirementRule>
        <AttributeRule attributeID="uid"> <PermitValueRule xsi:type="ANY" /> </AttributeRule>
     </AttributeFilterPolicy>

Sample azureclaims.xml
<bean parent="shibboleth.TranscodingProperties">
            <property name="properties">
                <props merge="true">
                    <prop key="id">uid</prop>
                    <prop key="transcoder">SAML2StringTranscoder</prop>
                    <prop key="saml2.name">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uid</prop<http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uid%3c/prop>>
                    <prop key="saml2.nameFormat">urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified</prop>
                    <prop key="displayName.en">uid</prop>
                    <prop key="description.en">Azure UPN of an account expected to be scoped thus transcoded that way</prop>
                </props>
            </property>
        </bean>

Saml message decoded:
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" > <AttributeValue>xyz</AttributeValue> </Attribute>
What I am not sure if azure ad adds name id subject which is in format  <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">xyz</NameID>. I am not sure this has anything to do with canonicalization
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250318/23aa7f89/attachment.htm>