<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>So I have a WebLogic 12c IdP “working” with a Shibboleth SP for version 2.4.3 running on IIS 7.5. The IdP and SP are both running on my local machine, while I figure out how to do all this. There are some page protection issues, but I worked around them by hitting the /Login with a target parameter set to the site I need to have SSO access to (I’m more worried about the communications between IdP and SP than site protection at the moment). I can see the assertions are being received by the SP because I have checked the logs and I am able to see not only the assertion XML in the log, but the SP is parsing it out and attempting to retrieve attributes from it.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Now comes in the part I’m stuck on. The WebLogic IdP won’t send a whole lot of info in the assertion, but among the pieces being sent that I find useful is the subject NameID node, because that contains the name of the user who’s involved in the SSO session. The XML node is in this format:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><saml:Subject><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" NameQualifier="<a href="http://www.mysite.com">www.mysite.com</a>">ssouser</saml:NameID><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>… more XML …<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal></saml:Subject><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The SP does actually parse this after I added this entry into the attribute-map.xml file:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" id="NameID"><o:p></o:p></p><p class=MsoNormal> <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$Name" defaultQualifiers="true"/><o:p></o:p></p><p class=MsoNormal></Attribute><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I can see in the shibd.log that it generates the session, and when I check the transaction.log, I see this:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]: New session (ID: _ef838acca244cf6f8b7c9b2be9bc58f9) with (applicationId: default) for principal from (IdP: saml2CMP) at (ClientAddress: 127.0.0.1) with (NameIdentifier: ssouser) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _0xdf9ec404c90318c0d9f4b9afe21b1067)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]: Cached the following attributes with session (ID: _ef838acca244cf6f8b7c9b2be9bc58f9) for (applicationId: default) {<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]: NameID (1 values)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 INFO Shibboleth-TRANSACTION [1]: }<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Now comes my problem. I can’t figure out how to retrieve that value, which would be used to display the active user. When I set tracing on for the ASP .NET page, I can see that a _shibsession object is added to the ALL_HTTP elements only after the SSO actions have been completed. Request.Headers(“NameID”) doesn’t work (always returns a null value). I’m not even sure if I’m using attributes appropriately, because none of the other shibboleth session values are generated (they all seem to be coming back null when I try Request.Headers(“Shib-property”)). This may be because the IdP is not sending a lot of info, or it could just be the fact that I’m new to all this. I’m using VB on .NET version 3.5.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here’s the log snippet from shibd.log that shows the attributes being extracted and the session constructed. The “group” attribute is ignored on purpose because it is not by the application the SP is designed to protect.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.SSO.SAML2 [1]: extracting pushed attributes...<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.AttributeDecoder.NameID [1]: decoding NameIDAttribute (NameID) from SAML 2 NameID with Format (urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: Groups, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:basic<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.AttributeFilter [1]: filtering 1 attribute(s) from (saml2CMP)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.AttributeFilter [1]: applying filtering rule(s) for attribute (NameID) from (saml2CMP)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.SSO.SAML2 [1]: resolving attributes...<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.AttributeResolver.Query [1]: found AttributeStatement in input to new session, skipping query<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.SessionCache [1]: creating new session<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG Shibboleth.SessionCache [1]: storing new session...<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG XMLTooling.StorageService [1]: inserted record (session) in context (_ef838acca244cf6f8b7c9b2be9bc58f9) with expiration (1343746880)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG XMLTooling.StorageService [1]: inserted record (ssouser) in context (NameID) with expiration (1343772080)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 DEBUG XMLTooling.StorageService [1]: inserted record (_0xdf9ec404c90318c0d9f4b9afe21b1067) in context (_ef838acca244cf6f8b7c9b2be9bc58f9) with expiration (1343746880)<o:p></o:p></p><p class=MsoNormal>2012-07-31 10:01:20 INFO Shibboleth.SessionCache [1]: new session created: ID (_ef838acca244cf6f8b7c9b2be9bc58f9) IdP (saml2CMP) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (127.0.0.1)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Jeff<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>