<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>A couple of thoughts:</div>
<div><br>
</div>
<div>1. What is your attribute filter doing? I'm thinking if you are not sending this other SP a name ID because none is defined it is simply redirecting back to the IdP.</div>
<div>2. Grab a copy of SAML Tracer for FF and use it to capture the SAML messages.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>dave massie <<a href="mailto:dave.massie@gmail.com">dave.massie@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Monday, April 23, 2012 10:26 AM<br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Problem with attribute resolver<br>
</div>
<div><br>
</div>
<div>
<div><br>
Here is the problem. We are migrating users away from one mail system to another mail system. We want users who have NOT been officially migrated to the new mail system to be unable to access the new mail system. We want this behavior because we will be provisioning
the users in the new system before we roll out the new system to the users.<br>
<br>
OK. So, what we have done is to create a principal name for the new system: <br>
<br>
<!-- BEGIN GOOGLE NAME ID --> <br>
<resolver:AttributeDefinition id="GooglePrincipal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad"<br>
sourceAttributeID="uid" ><br>
<resolver:Dependency ref="GoogleLDAP" /><br>
<br>
<resolver:AttributeEncoder xsi:type="SAML2StringNameID"<br>
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /><br>
<br>
<br>
</resolver:AttributeDefinition ><br>
<!-- END GOOGLE NAME ID --> <br>
<br>
And for the ldap query to get the principal name we have created an ldap connector called GoogleLDAP. Here it is:<br>
<br>
<resolver:DataConnector xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"<br>
id="GoogleLDAP"<br>
ldapURL="ldaps://<a href="http://directory.georgetown.edu">directory.georgetown.edu</a>"<br>
baseDN="dc=georgetown,dc=edu"<br>
principal="cn=uidWebMapping1,ou=Specials,dc=georgetown,dc=edu"<br>
principalCredential="uidWebMapping"<br>
noResultIsError="true"><br>
<br>
<br>
<br>
<FilterTemplate><br>
<![CDATA[<br>
(&(uid=${requestContext.principalName})(|(guService=GUMail.GAE.Migration.Complete.*)(guService=GUMail.GAE.Migration.<br>
Candidate)))<br>
]]><br>
</FilterTemplate><br>
<br>
Note that the query will return a value only when the guService attributes are correctly populated.<br>
<br>
We have tested and people without the correct guService attributes are denied access. This is good.<br>
<br>
However, when a person without the guService attributes tries to log into some other SP we get the error (from idp-process.log):<br>
<br>
WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:465] - Error resolving at<br>
tributes for principal 'dhm24'. No name identifier or attribute statement will be included in response<br>
<br>
The browser appears to be in a loop of some sort. I have not been able to see the url's because they are going by too fast.<br>
<br>
Does anyone have any ideas as to what my problem is?<br>
<br>
Thanks,<br>
<br>
Dave<br>
</div>
</div>
</span>
</body>
</html>