Metadata-Based Naming?

[Wil Cooley]

I probably should not bother sending this, because I figured it out, but I
am sending it just in case someone enjoys reading through someone else's
troubleshooting/pain.

----

I am experimenting with the metadata-driven attribute renaming as documented
<https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510658/SAML2AttributeTranscoderConfiguration#Metadata-Based-Naming-5.1>
.
This is Shibboleth IdP 5.1.6. I have metadata-driven configuration working
in general: attribute release, disabling assertion encryption, etc.

For my test case, I'm trying to switch the "last_name" attribute for Slack
from using a dedicated AttributeDefinition to just renaming "sn".

>From what I understand, I need to:
1. Disable the appropriate AttributeDefinition in "conf/attribute-resolver.xml"
for the attribute I've given id="slack_last_name" (saml2 name="last_name").
2. Reload attribute services and check with "aacli" that the attribute is
gone.
3. Add "saml2.nameFromMetadata" to "conf/attributes/inetOrgPerson.xml" for
id="sn":

> --- a/conf/attributes/inetOrgPerson.xml
> +++ b/conf/attributes/inetOrgPerson.xml
> @@ -407,2 +407,3 @@
>                      <prop key="id">sn</prop>
> +                    <prop key="saml2.nameFromMetadata">true</prop>
>                      <prop key="transcoder">SAML2StringTranscoder
> SAML1StringTranscoder</prop>

(I presume I can move this override to a custom property file once I've got
it working.)
4. Ensure the attribute is not being filtered. I have existing rules that
allow both "sn" and "last_name" (the latter for https://slack.com only).
5. Add the remap to the metadata:

> --- a/metadata/local/bbdf76bc0699a6b54c94731980fef51be1b20fb1.xml

+++ b/metadata/local/bbdf76bc0699a6b54c94731980fef51be1b20fb1.xml

@@ -14,6 +19,9 @@

      ...

     </saml2:Attribute>
> +      <saml2:Attribute Name="
> http://shibboleth.net/ns/attributes/naming/saml2"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> +        <saml2:AttributeValue>sn last_name</saml:AttributeValue>
> +    </saml2:Attribute>
>      </mdattr:EntityAttributes>
>    </Extensions>

6. Reload attribute services.
7. Reload metadata provider: "reload-metadata.sh -id local"
8. Run "aacli --saml2 -n wcooley -r https://slack.com" and see an attribute
Name="last_name" (and presumably, no attribute Name="sn").

I have set idp.loglevel.root, net.shibboleth.idp.saml.attribute.mapping and
net.shibboleth.idp.attribute.resolver to "DEBUG" in logback.xml. I see
debug messages, but nothing is obvious, other than that it's still
processing "sn" as "sn".

Update 1: I set "net.shibboleth.idp.attribute" to DEBUG and now I see this:

 - DEBUG
> [net.shibboleth.idp.attribute.transcoding.AbstractAttributeTranscoder:140]
> - 127.0.0.1||No tag values found for metadata-driven naming for sn


Update 2: I have written all this out and while doing so, I see my problem.
I thought, "I pretty much copied this from the wiki" and looked back at the
example in the wiki and then remembered, "except I had to change the XML
namespace prefix to match mine."

Do you see the error in the snippet of XML I included above?

How the heck did XML validation let this pass? "xmllint" makes no complaint
about it.

Wil
-- 
Wil Cooley <wcooley(at)pdx.edu>
OIT-TI Identity and Access Management
Portland State University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260702/bc062e12/attachment.htm>