So, admittedly being very much new to the world of SP's and trying to set up my own, learning as I go... I'm struggling to troubleshoot why I can't release attributes (mainly eppn). I've attempted to trace from left to right whats going on and I'm pretty confident my IdP is appropriately releasing the attribute with a value in it. But when I get over to the SP, that is where what little experience I have leaves me and i'm at a loss. My understanding is the attribute-map is supposed to control this, but by all accounts, I've married up the attribute definition there to match eppn. But logs, php test script, and shibboleth.sso/session all show me nothing. I was hoping someone with more SP experience might be able to follow my though process here and tell me what I've failed to check and where things might still go wrong. I'd appreciate any learning experience here you can teach me...<br>
<br>Thanks<br>-Rob<br><br><u><br>IDP's attribute definition for eppn:</u><br> <resolver:AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped"<br> xmlns="urn:mace:shibboleth:2.0:resolver:ad" scope="<a href="http://uncg.edu" target="_blank">uncg.edu</a>"><br>
<resolver:Dependency ref="scriptUserName" /><br> <resolver:AttributeEncoder xsi:type="SAML1ScopedString"<br> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" /><br>
<resolver:AttributeEncoder xsi:type="SAML2ScopedString"<br> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"<br> friendlyName="eduPersonPrincipalName" /><br>
</resolver:AttributeDefinition><br> <br><u>IDP's filter releasing eppn..</u><b>.</b><br> <AttributeFilterPolicy id="GrouperSSO"><br> <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="https://dlx-grouperui.uncg.edu/shibboleth" target="_blank">https://dlx-grouperui.uncg.edu/shibboleth</a>" /><br>
<AttributeRule attributeID="eduPersonPrincipalName"><br> <PermitValueRule xsi:type="basic:ANY" /><br> </AttributeRule><br> </AttributeFilterPolicy><br>
<u><br>IDP process log showing my DataConnector was able to obtain a value for eppn and matched it to my filter:</u><br><div style="margin-left:40px">09:52:06.868 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307] - Resolved attribute eduPersonPrincipalName containing 1 value<br>
09:52:06.878 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:131] - Filter policy GrouperSSO is active for principal rwgorrel<br>09:52:06.878 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:156] - Processing permit value rule for attribute eduPersonPrincipalName for principal rwgorrel<br>
</div><br><u>IDP audit log entry showing eppn was released:</u><br><div style="margin-left:40px">20130510T125726Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_0ab26240858780515a59e91adfccde8a|<a href="https://dlx-grouperui.uncg.edu/shibboleth%7Curn:mace:shibboleth:2.0:profiles:saml2:sso%7Chttps://idp-d.uncg.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_8a614609d06b27373e13ebcc6f3234e8%7Crwgorrel%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" target="_blank">https://dlx-grouperui.uncg.edu/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp-d.uncg.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_8a614609d06b27373e13ebcc6f3234e8|rwgorrel|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</a><b>|</b>eduPersonPrincipalName,transientId,eduPersonTargetedID,||_154e18d723e1e467dc44e8ddf2774538,|<br>
</div><br clear="all"><u>SP's attribute map mapping eppn:</u><br> <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName" id="eppn"><br> <AttributeDecoder xsi:type="ScopedAttributeDecoder"/><br>
</Attribute><br> <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn"><br> <AttributeDecoder xsi:type="ScopedAttributeDecoder"/><br> </Attribute><br>
<br><u>SP's shibboleth2.xml</u><br> <ApplicationDefaults id="default" policyId="default"<br> entityID="<a href="https://dlx-grouperui.uncg.edu/shibboleth" target="_blank">https://dlx-grouperui.uncg.edu/shibboleth</a>"<br>
REMOTE_USER="eppn persistent-id targeted-id"<br> signing="false" encryption="false"><br><br><u>SP's transaction.log showing only persistent-id coming through:</u><br>
<div style="margin-left:40px">2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]: New session (ID: _eb7997afba33868972604b5a956ce1f7) with (applicationId: default) for principal from (IdP: <a href="https://idp-d.uncg.edu/idp/shibboleth" target="_blank">https://idp-d.uncg.edu/idp/shibboleth</a>) at (ClientAddress: 10.80.200.134) with (NameIdentifier: _facc00094d6a9cfa510f3d03e59d32d6) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _154e18d723e1e467dc44e8ddf2774538)<br>
2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]: Cached the following attributes with session (ID: _eb7997afba33868972604b5a956ce1f7) for (applicationId: default) {<br>2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]: persistent-id (1 values)<br>
2013-05-10 08:57:36 INFO Shibboleth-TRANSACTION [25]: }<br></div><br><br>What gives?! Where's it getting lost/dropped?<br><br><br>-- <br><div>Robert W. Gorrell<br>Middleware Engineer, Identity and Access Management</div>
<div>University of NC at Greensboro<br><a href="tel:336-334-5954" value="+13363345954" target="_blank">336-334-5954</a></div>