Hi All,<div><br></div><div>My team is setting up a Shibboleth2 SP and will be integrating with an IBM Tivoli based IDP.  We have the connection in place as well as the authentication flows.  What we are having trouble with now is decoding the attributes coming back from the IDP.  Most of them have a name format URI of <span style="color:rgb(26,26,166);font-family:monospace;font-size:medium;white-space:pre-wrap">urn:ibm:names:ITFIM:5.1:accessmanager, </span>and we aren&#39;t sure if we have to do anything extra to allow our SP to understand those formats.  We have the attributes defined in attribute-map.xml like this: </div>
<div><br></div><div><div>    &lt;Attribute nameformat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot; name=&quot;altId&quot;&gt;</div><div>        &lt;AttributeDecoder xsi:type=&quot;StringAttributeDecoder&quot; caseSensitive=&quot;false&quot;/&gt;</div>
<div>    &lt;/Attribute&gt;</div><div>    &lt;Attribute nameformat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot; name=&quot;zip&quot;&gt;</div><div>        &lt;AttributeDecoder xsi:type=&quot;StringAttributeDecoder&quot; caseSensitive=&quot;false&quot;/&gt;</div>
<div>    &lt;/Attribute&gt;</div><div>    &lt;Attribute nameformat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot; name=&quot;dob&quot;&gt;</div><div>        &lt;AttributeDecoder xsi:type=&quot;StringAttributeDecoder&quot; caseSensitive=&quot;false&quot;/&gt;</div>
<div>    &lt;/Attribute&gt;</div><div>    &lt;Attribute nameformat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot; name=&quot;email&quot;&gt;</div><div>        &lt;AttributeDecoder xsi:type=&quot;StringAttributeDecoder&quot; caseSensitive=&quot;false&quot;/&gt;</div>
<div>    &lt;/Attribute&gt;</div><div>    &lt;Attribute nameformat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot; name=&quot;lastname&quot;&gt;</div><div>        &lt;AttributeDecoder xsi:type=&quot;StringAttributeDecoder&quot; caseSensitive=&quot;false&quot;/&gt;</div>
<div>    &lt;/Attribute&gt;</div><div>    &lt;Attribute nameformat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot; name=&quot;firstname&quot;&gt;</div><div>        &lt;AttributeDecoder xsi:type=&quot;StringAttributeDecoder&quot; caseSensitive=&quot;false&quot;/&gt;</div>
<div>    &lt;/Attribute&gt;</div><div>    &lt;Attribute nameformat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot; name=&quot;username&quot;&gt;</div><div>        &lt;AttributeDecoder xsi:type=&quot;StringAttributeDecoder&quot; caseSensitive=&quot;false&quot;/&gt;</div>
<div>    &lt;/Attribute&gt; </div><div><br></div><div>And we have our attribute-policy.xml looks like this (We think this should just accept everything):</div><div>&lt;afp:AttributeFilterPolicyGroup</div><div>    xmlns=&quot;urn:mace:shibboleth:2.0:afp:mf:basic&quot;</div>
<div>    xmlns:basic=&quot;urn:mace:shibboleth:2.0:afp:mf:basic&quot;</div><div>    xmlns:afp=&quot;urn:mace:shibboleth:2.0:afp&quot;</div><div>    xmlns:xsi=&quot;<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>&quot;&gt;</div>
<div><br></div><div>&lt;afp:AttributeFilterPolicy&gt;</div><div>&lt;!-- This policy is in effect in all cases. --&gt;</div><div>&lt;afp:PolicyRequirementRule xsi:type=&quot;ANY&quot;/&gt;</div><div>&lt;afp:AttributeRule attributeID=&quot;*&quot;&gt;</div>
<div>&lt;afp:PermitValueRule xsi:type=&quot;ANY&quot;/&gt;</div><div>&lt;/afp:AttributeRule&gt;</div><div>&lt;/afp:AttributeFilterPolicy&gt;</div><div>&lt;/afp:AttributeFilterPolicyGroup&gt;</div><div><br></div><div>And a snippet of the attributes that come from the IDP look like this:</div>
<div><div>&lt;saml:AttributeStatement&gt;&lt;saml:Attribute Name=&quot;id&quot; NameFormat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot;&gt;&lt;saml:AttributeV</div><div>alue xsi:type=&quot;xs:string&quot;&gt;525080438&lt;/saml:AttributeValue&gt;&lt;/saml:Attribute&gt;&lt;saml:Attribute Name=&quot;altId&quot; NameFormat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot;&gt;&lt;saml:AttributeValue xsi:ty</div>
<div>pe=&quot;xs:string&quot;&gt;U00049591&lt;/saml:AttributeValue&gt;&lt;/saml:Attribute&gt;&lt;saml:Attribute Name=&quot;zip&quot; NameFormat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot;&gt;&lt;saml:AttributeValue xsi:type=&quot;xs:string</div>
<div>&quot;&gt;02891&lt;/saml:AttributeValue&gt;&lt;/saml:Attribute&gt;&lt;saml:Attribute Name=&quot;dob&quot; NameFormat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot;&gt;&lt;saml:AttributeValue xsi:type=&quot;xs:string&quot;&gt;1951-01-01&lt;/sam</div>
<div>l:AttributeValue&gt;&lt;/saml:Attribute&gt;&lt;saml:Attribute Name=&quot;email&quot; NameFormat=&quot;urn:ibm:names:ITFIM:5.1:accessmanager&quot;&gt;&lt;saml:AttributeValue xsi:type=&quot;xs:string&quot;&gt;tri.chaugfdjjytrddhjjk@ci</div>
<div><a href="http://gna.com">gna.com</a>&lt;/saml:AttributeValue&gt;</div></div><div><br></div><div>Also, we are running Shibboleth 2.3 on Ubuntu 10.04 LTS.</div><div><br></div><div>Thank you,</div><div><br></div><div>Rob Whitener</div>
<div><br></div><div>       </div></div>