<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://1341/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">David,<div><br></div><div>You are indeed sending eduPersonScopedAffiliation:</div><div><br></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">16:02:21.425 - INFO [Shibboleth-Audit:989] - 20121120T160221Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_17f555f56a5a1d4c0f8002ec042c9314|<a href="https://sp.testshib.org/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://java.cms.livjm.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_347d7854e5a6550ac3fea58c03741402|cmsdwynn|urn:oasis:names:tc:SAML:2.0:ac:classes" style="color: purple; ">https://sp.testshib.org/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://java.cms.livjm.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_347d7854e5a6550ac3fea58c03741402|cmsdwynn|urn:oasis:names:tc:SAML:2.0:ac:classes</a></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,|_72da3968a255614eb5d7a94fb808c4de||</span></div></div><div><br></div><div>That means it's most likely being dropped by the SP. The TestShib SP exposes its logs to the public, so we can see what's happening:</div><div><br></div><div><pre style="word-wrap: break-word; white-space: pre-wrap; ">2012-11-20 11:02:05 DEBUG OpenSAML.MessageDecoder.SAML2 [23]: message from (<a href="https://java.cms.livjm.ac.uk/idp/shibboleth">https://java.cms.livjm.ac.uk/idp/shibboleth</a>)</pre></div><div><pre style="word-wrap: break-word; white-space: pre-wrap; ">...</pre><pre style="word-wrap: break-word; white-space: pre-wrap; "><saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">member</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></pre><div>...</div></div><div><br></div><div>To be a valid eduPersonScopedAffiliation, it must use one of the controlled vocabulary (check), and it must be scoped to a domain that the IdP is authoritative for(not there). Try making sure that the metadata you uploaded to TestShib includes your domain (<a href="http://ljmu.ac.uk">ljmu.ac.uk</a> or <a href="http://livjm.ac.uk">livjm.ac.uk</a> preferred; it currently says just "<a href="http://ac.uk">ac.uk</a>") as a valid Scope, and then include that scope in the attribute value that is generated by the script.</div><div><br></div><div>Thanks,</div><div>Nate.</div><div><br><div><div>On 20 Nov 2012, at 16:24, "Wynne, David" <<a href="mailto:D.Wynne@ljmu.ac.uk">D.Wynne@ljmu.ac.uk</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-GB" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">First thanks to everyone who helped with my Windows AD authentication. It is working now.</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">I'm trying to send an attribute tt testshib two but I’m not sure if it's working. I thought it would appear in the</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">Shibboleth-protected TestShib Content</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">But it doesn't. The attribute is defined in attribute-resolver.xml:</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">Shibboleth-protected TestShib Content</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <resolver:AttributeDefinition</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> id="eduPersonScopedAffiliation"</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> xsi:type="Script"</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> xmlns="urn:mace:shibboleth:2.0:resolver:ad" ></span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <resolver:Dependency ref="myLDAP" /></span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <resolver:AttributeEncoder</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> xsi:type="SAML1String"</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> name="urn:mace:dir:attribute-def:eduPersonScopedAffiliat</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">ion"/></span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <resolver:AttributeEncoder</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> xsi:type="SAML2String"</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> friendlyName="eduPersonScopedAffiliation"/></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <Script></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <![CDATA[</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> importPackage(Packages.edu.internet2.middleware.</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">shibboleth.common.attribute.provider);</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> eduPersonScopedAffiliation = new BasicAttribute(</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">"eduPersonScopedAffiliation");</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> dn = distinguishedName.getValues().get(0).toLowe</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">rCase();</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> if (dn.contains("ou=staff")) {</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> eduPersonScopedAffiliation.getValues().a</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">dd("staff");</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> } else if (dn.contains("ou=student")) {</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> eduPersonScopedAffiliation.getValues().a</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">dd("student");</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> } else {</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> eduPersonScopedAffiliation.getValues().a</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">dd("member");</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> }</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> ]]></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </Script></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </resolver:AttributeDefinition></span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">And in attribute-filter.xml:</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone"></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <afp:PolicyRequirementRule xsi:type="basic:ANY" /></span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <afp:AttributeRule attributeID="eduPersonScopedAffiliation"></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <afp:PermitValueRule xsi:type="basic:ANY" /></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </afp:AttributeRule></span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </afp:AttributeFilterPolicy></span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">But in the idp-process.log is says Removing attribute eduPersonScopedAffiliation ?</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">ring.provider.ShibbolethAttributeFilteringEngine:109] - Attribute eduPersonScopedAffiliation has 1 values after filtering</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">16:02:21.377 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:114] - Filtered attributes for</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">principal cmsdwynn. The following attributes remain: [transientId, eduPersonScopedAffiliation]</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">16:02:21.378 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provi</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">der.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute eduPersonScopedAffiliation with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">16:02:21.379 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSA</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">MLProfileHandler:528] - Removing attribute eduPersonScopedAffiliation, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> <saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">16:02:21.425 - INFO [Shibboleth-Audit:989] - 20121120T160221Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_17f555f56a5a1d4c0f8002ec042c9314|<a href="https://sp.testshib.org/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://java.cms.livjm.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_347d7854e5a6550ac3fea58c03741402|cmsdwynn|urn:oasis:names:tc:SAML:2.0:ac:classes" style="color: purple; text-decoration: underline; ">https://sp.testshib.org/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://java.cms.livjm.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_347d7854e5a6550ac3fea58c03741402|cmsdwynn|urn:oasis:names:tc:SAML:2.0:ac:classes</a></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; ">:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,|_72da3968a255614eb5d7a94fb808c4de||</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 16pt; "> </span></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span>Dave Wynne</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span>Senior Technical Officer</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span>School Of Computing & Maths</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span>James Parsons Building</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span>Liverpool John Moores University</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span>Byrom Street</span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span>Liverpool L3 3AF</span></div><p class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "> </p></div><br><hr><font face="Tahoma" size="2"><b><i>Important Notice:<i></i></i></b><i><i><i><span class="Apple-converted-space"> </span>the information in this email and any attachments is for the sole use of the intended recipient(s). If you are not an intended recipient, or a person responsible for delivering it to an intended recipient, you should delete it from your system immediately without disclosing its contents elsewhere and advise the sender by returning the email or by telephoning a number contained in the body of the email. No responsibility is accepted for loss or damage arising from viruses or changes made to this message after it was sent. The views contained in this email are those of the author and not necessarily those of Liverpool John Moores University.<i></i></i></i></i></font><i> </i>--<br>To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: purple; text-decoration: underline; ">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br></div></body></html>