<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>We’re having a problem with a SAML1 Service Provider (<a href="https://soadev.nih.gov/FederationGateway">https://soadev.nih.gov/FederationGateway</a>). When we attempt to login, I can see that our IDP is pulling and preparing to encode the attributes we allow for InCommon. The attributes come up in the uApprove screen to, but when we redirect back to the SP, the logs say that it can’t encode our attributes using the SAML1 encoder. I’ve also included part of our attribute-resolve below. Are our SAML1 AttributeEncoders correct or should those xsi:type attributes be something else? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>10:31:39.376 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:113] - Filtered attributes for principal <myusername>. The following attributes remain: [eduPersonPrincipalName, surname, eduPersonScopedAffiliation, givenName, eduPersonTargetedID, email, displayName]<o:p></o:p></p><p class=MsoNormal>10:31:39.379 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml1.ShibbolethSSOEndpointSelector:79] - Selecting endpoint from metadata corresponding to provided ACS URL: 'https://citdecadssolog.nih.gov/affwebservices/public/samlcc'<o:p></o:p></p><p class=MsoNormal>10:31:39.379 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml1.ShibbolethSSOEndpointSelector:83] - Relying party role contains '3' endpoints<o:p></o:p></p><p class=MsoNormal>10:31:39.382 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:509] - Filtering out potential name identifier attributes which can not be encoded by edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.383 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute eduPersonPrincipalName, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.383 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute surname, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.384 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute eduPersonScopedAffiliation, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.384 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute givenName, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.384 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute eduPersonTargetedID, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.384 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute email, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.385 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute displayName, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML1NameIdentifierEncoder<o:p></o:p></p><p class=MsoNormal>10:31:39.385 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:486] - No attributes for principal '<me again>' support encoding into a supported name identifier format for relying party 'https://soadev.nih.gov/FederationGateway'<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Attribute-resolver partial:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> <resolver:AttributeDefinition xsi:type="ad:Simple" id="commonName" sourceAttributeID="cn"><o:p></o:p></p><p class=MsoNormal> <resolver:Dependency ref="myLDAP" /><o:p></o:p></p><p class=MsoNormal> <resolver:DisplayName xml:lang="en">Username</resolver:DisplayName><o:p></o:p></p><p class=MsoNormal> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:cn" /><o:p></o:p></p><p class=MsoNormal> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.3" friendlyName="cn" /><o:p></o:p></p><p class=MsoNormal> </resolver:AttributeDefinition><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> <resolver:AttributeDefinition xsi:type="ad:Simple" id="surname" sourceAttributeID="sn"><o:p></o:p></p><p class=MsoNormal> <resolver:Dependency ref="myLDAP" /><o:p></o:p></p><p class=MsoNormal> <resolver:DisplayName xml:lang="en">Last Name</resolver:DisplayName><o:p></o:p></p><p class=MsoNormal> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" /><o:p></o:p></p><p class=MsoNormal> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" /><o:p></o:p></p><p class=MsoNormal> </resolver:AttributeDefinition><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> <resolver:AttributeDefinition xsi:type="ad:Simple" id="displayName" sourceAttributeID="fullName"><o:p></o:p></p><p class=MsoNormal> <resolver:Dependency ref="myLDAP" /><o:p></o:p></p><p class=MsoNormal> <resolver:DisplayName xml:lang="en">Full Name</resolver:DisplayName><o:p></o:p></p><p class=MsoNormal> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:displayName" /><o:p></o:p></p><p class=MsoNormal> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.16.840.1.113730.3.1.241" /><o:p></o:p></p><p class=MsoNormal> </resolver:AttributeDefinition><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>…etc<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sumit Khanna<o:p></o:p></p><p class=MsoNormal>Application Analyist <o:p></o:p></p><p class=MsoNormal>EAI Team - University of Cincinnati <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>