Hi Rob,<div>I recently had to do the same thing but ended up with something much simpler than you describe.</div><div><br></div><div>In 'shibboleth2.xml' I have:</div><div><div><SSO entityID="<a href="https://some.url.for.your.Idp">https://some.url.for.your.Idp</a>" </div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>NameIDFormat="nameIDformat.that.you.want.to.use"></div><div> SAML2 SAML1</div><div> </SSO></div></div><div><br>
</div><div>... and then in 'attribute-map.xml'... (for example)</div><div><Attribute name="nameIDformat.that.you.want.to.use" id="varname"/></div><div><br></div><div>... and finally back in 'shibboleth2.xml'...</div>
<div>REMOTE_USER="varname"</div><div><br></div><div>That's all I needed. Hopefully this will help...</div><div>Regards, Pete</div><div><br><div class="gmail_quote">On 2 July 2012 22:28, Rob Whitener <span dir="ltr"><<a href="mailto:rob.whitener@audaxhealth.com" target="_blank">rob.whitener@audaxhealth.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi All,<div><br></div><div>My team is setting up a Shibboleth2 SP and will be integrating with an IBM Tivoli based IDP. We have the connection in place as well as the authentication flows. What we are having trouble with now is decoding the attributes coming back from the IDP. Most of them have a name format URI of <span style="color:rgb(26,26,166);font-family:monospace;font-size:medium;white-space:pre-wrap">urn:ibm:names:ITFIM:5.1:accessmanager, </span>and we aren't sure if we have to do anything extra to allow our SP to understand those formats. We have the attributes defined in attribute-map.xml like this: </div>
<div><br></div><div><div> <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager" name="altId"></div><div> <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/></div>
<div> </Attribute></div><div> <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager" name="zip"></div><div> <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/></div>
<div> </Attribute></div><div> <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager" name="dob"></div><div> <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/></div>
<div> </Attribute></div><div> <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager" name="email"></div><div> <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/></div>
<div> </Attribute></div><div> <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager" name="lastname"></div><div> <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/></div>
<div> </Attribute></div><div> <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager" name="firstname"></div><div> <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/></div>
<div> </Attribute></div><div> <Attribute nameformat="urn:ibm:names:ITFIM:5.1:accessmanager" name="username"></div><div> <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/></div>
<div> </Attribute> </div><div><br></div><div>And we have our attribute-policy.xml looks like this (We think this should just accept everything):</div><div><afp:AttributeFilterPolicyGroup</div><div> xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"</div>
<div> xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"</div><div> xmlns:afp="urn:mace:shibboleth:2.0:afp"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"></div>
<div><br></div><div><afp:AttributeFilterPolicy></div><div><!-- This policy is in effect in all cases. --></div><div><afp:PolicyRequirementRule xsi:type="ANY"/></div><div><afp:AttributeRule attributeID="*"></div>
<div><afp:PermitValueRule xsi:type="ANY"/></div><div></afp:AttributeRule></div><div></afp:AttributeFilterPolicy></div><div></afp:AttributeFilterPolicyGroup></div><div><br></div><div>And a snippet of the attributes that come from the IDP look like this:</div>
<div><div><saml:AttributeStatement><saml:Attribute Name="id" NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeV</div><div>alue xsi:type="xs:string">525080438</saml:AttributeValue></saml:Attribute><saml:Attribute Name="altId" NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue xsi:ty</div>
<div>pe="xs:string">U00049591</saml:AttributeValue></saml:Attribute><saml:Attribute Name="zip" NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue xsi:type="xs:string</div>
<div>">02891</saml:AttributeValue></saml:Attribute><saml:Attribute Name="dob" NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue xsi:type="xs:string">1951-01-01</sam</div>
<div>l:AttributeValue></saml:Attribute><saml:Attribute Name="email" NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue xsi:type="xs:string">tri.chaugfdjjytrddhjjk@ci</div>
<div><a href="http://gna.com" target="_blank">gna.com</a></saml:AttributeValue></div></div><div><br></div><div>Also, we are running Shibboleth 2.3 on Ubuntu 10.04 LTS.</div><div><br></div><div>Thank you,</div><div>
<br></div><div>Rob Whitener</div>
<div><br></div><div> </div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><span style="font-family:arial,sans-serif;font-size:13px;border-collapse:collapse">
<p style="margin:0px"><b>Peter L.K. Newing, CISSP, CISA, ITIL V3 Foundation, ISO 27001 Lead Auditor</b></p>
<p style="margin:0px"><b><span lang="EN-GB">Director of </span></b><b><span lang="EN-GB">Product Management</span></b></p>
<p style="margin:0px"><b><span lang="EN-GB"> </span></b></p>
<div style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB">UK Mobile: +44 7545 073 406</span></div><div style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB">US Mobile: +1 424 789 0265</span></div>
<p style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB"> </span></p>
<p style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB">Flexeye Technology Ltd</span></p>
<p style="margin:0px"><span style="font-family:"Imprint MT Shadow"" lang="EN-GB"> </span></p>
<p style="margin:0px"><span style="font-family:Consolas;font-size:8pt">This email and any attachments are confidential and may be privileged. If you have received it in error, do not read it, copy it, forward it, disclose its contents or use it for any purpose. Please notify us immediately and then delete it. Any views or opinions expressed are solely those of the author and not necessarily those of Flexeye Technology Ltd. This email was sent from Flexeye Technology Limited, Hays House, Millmead, Guildford GU2 4HJ. Registered Office: Wey Court West, Union Road, Farnham, Surrey GU9 7PT United Kingdom. Registered in England No 4852559. VAT no GB 821 3432 66A</span></p>
</span><br>
</div>