<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>Thanks, Nate. I will define the attributes on my side using the unknown value for the format.</span></div><div><br></div> <div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Nate Klingenstein <ndk@internet2.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, June 20, 2012 11:25 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Getting attributes from an OpenAM 10 Idp<br> </font> </div> <br>
Mike,<br><br>> I am running Shibboleth 2.x on IIS.<br>><br>> I am trying to get attributes to pass from an Idp based on the <br>> OpenAM 10 service. We connect just fine. Just trying to get the <br>> attributes to pass through...<br>><br>> They are passing a standard LDAP mail attribute.<br><br>This isn't really "standard". The name is hopelessly not unique. The <br>proper unique name for the mail attribute would be name="urn:oid:0.9.2342.19200300.100.1.3 <br>", friendlyName="mail", and a nameFormat of NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri <br>".<br><br>But it may not be too feasible to make this change on their end, so to <br>make a change on yours, read on.<br><br>> From their assertion:<br>><br>> <saml:AttributeStatement><br>> <saml:Attribute Name="mail"><br>> <saml:AttributeValue xmlns:xs="http://www.w3.org/ 2001/XMLSchema"
<br>> xmlns:xsi="<a href="http://www.w3.org/" target="_blank">http://www.w3.org/</a> 2001/XMLSchema-instance" <br>> xsi:type="xs:string">auser@ someplace.com</saml: AttributeValue><br>> </saml:Attribute><br>> </saml:AttributeStatement><br>><br>> And their configuration defines mail as this:<br>><br>> <saml:Attribute Name="mail"><br>> <saml:AttributeValue xmlns:xs="<a href="http://www.w3.org/" target="_blank">http://www.w3.org/</a> 2001/XMLSchema" <br>> xmlns:xsi="<a href="http://www.w3.org/" target="_blank">http://www.w3.org/</a> 2001/XMLSchema-instance" <br>> xsi:type="xs:string">cayetano@ adobe.com</saml: AttributeValue><br>> </saml:Attribute><br>><br>> Now I have mail defined as this (default definition that came with <br>> Shib):<br>><br>> <Attribute name="urn:mace:dir:attribute- def:mail"
id="mail"/><br>><br>> I am going to guess that the mace urn is not going to fly for them <br>> on this. For another customer I defined an attribute for them like <br>> this:<br>> <Attribute name="qcmail" nameFormat="urn:oasis:names: tc:SAML: <br>> 2.0:attrname-format: basic" id="qcmail"><br>> <AttributeDecoder xsi:type=" StringAttributeDecoder" <br>> caseSensitive="false"/><br>> </Attribute><br>><br>> And that worked fine. I am guessing that I will need to do a <br>> similar definition for mail (non MACE) for this to pass through. My <br>> questions are:<br>><br>> Is the MACE name indeed what prevents the attribute from passing? <br>> Since they would not match that name value on their side...<br><br>It's not that the MACE name is "preventing" an attribute from <br>passing. The SP is receiving an
attribute with a name and nameFormat <br>that it doesn't recognize and it doesn't know how to handle it.<br><br>> Next question (assuming that the MAC name is not going to fly...):<br>><br>> If I re-define, let's say, mail for example and I do it like this:<br>><br>> <Attribute name="mail" nameFormat="urn:oasis:names: tc:SAML: <br>> 2.0:attrname-format: basic" id="mail"><br>> <AttributeDecoder xsi:type=" StringAttributeDecoder" <br>> caseSensitive="false"/><br>> </Attribute><br><br>This is close, but with no nameFormat in the attribute, I believe <br>you'll want :attrname-format:undefined rather than :attrname- <br>format:basic.<br><br>> Will the duplicate ID value of 'mail' conflict with the MACE version <br>> of the attribute?<br><br>The ID determines which header/environment variable the attribute is <br>placed into and how it is known to the rest of
the SP. You may map <br>many SAML attributes to one internal ID, or each SAML attribute to its <br>own internal ID; pick the behavior that you desire.<br><br>Take care,<br>Nate.<br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br> </div> </div> </div></body></html>