<div dir="ltr">Lorenz, have you tried using the aacli shell script (in the /bin directory of the IdP install)? It will show you what would actually be released to a given SP.<div><br></div><div>I usually make a copy of it, then edit it to specify the entity ID of the SP I'm testing. Here's an example, using my own account as the principal (the account being queried):</div>
<div><br></div><div>./aacli.sh --principal=kborecky --configDir=$IDP_HOME/conf --requester=<a href="https://sp.smith.edu/shibboleth">https://sp.smith.edu/shibboleth</a><br></div><div><br></div><div>Before you run it, you have to set the environment variables for IDP_HOME and JAVA_HOME - this is what I use:</div>
<div><br></div><div><div>IDP_HOME=/opt/shibboleth-idp;export IDP_HOME</div><div>JAVA_HOME=/usr/lib64/jre;export JAVA_HOME</div></div><div><br></div><div>Note that you also need to have the servlet-api-2.4.jar in the IdP's lib directory - newer installs of the IdP don't seem to have it, but you can get it from an older version. (Not sure if that is still true, that it isn't in there for newer versions...)</div>
<div><br></div><div>So, when you run this script, it will produce xml output that should list the attributes you're expecting. If it doesn't, then I think you want to check your attribute filter file to be sure you're releasing the attributes to that SP..</div>
<div><br></div><div>If it does list them properly, then maybe you haven't configured them in your SP's attribute map?</div><div><br></div><div>Hope this helps, and wasn't TMI -</div><div><br></div><div>Karla</div>
<div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Aug 20, 2013 at 12:05 PM, Ulrich Lorenz PH Luzern <span dir="ltr"><<a href="mailto:lorenz.ulrich@phlu.ch" target="_blank">lorenz.ulrich@phlu.ch</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="DE-CH" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Hello everyone<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">I’m currently setting up a Vagrant box as development base for one of our projects. Since we authenticate using Shibboleth, the same is also needed for the dev
environment.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">We’re running several SPs, all of them in PHP/MySQL environments, and didn’t have any problems apart from the usual beginner pitfalls.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">In my Vagrant box I have a really weird problem and didn’t find a hint how to solve it, neither in the logs, nor in the archive:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">The authentication to works fine and the IdP redirects back to the SP. The Shibboleth session looks OK:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><u><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Miscellaneous</span></u><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New""><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Client Address:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">
192.168.23.1<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Identity Provider:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">
<a href="https://idp.phlu.ch/idp/shibboleth" target="_blank">https://idp.phlu.ch/idp/shibboleth</a><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">SSO Protocol:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">
urn:oasis:names:tc:SAML:2.0:protocol<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Authentication Time:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">
2013-08-20T15:46:44.611Z<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Authentication Context Class:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Authentication Context Decl:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">
(none)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Session Expiration (barring inactivity):</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">
479 minute(s)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New""><u></u> <u></u></span></p>
<p class="MsoNormal"><u><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">Attributes</span></u><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New""><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">[some other attributes]</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New""><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">affiliation</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
2 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">givenName</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
1 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">homeOrganization</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
1 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">homeOrganizationType</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
1 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">mail</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
1 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">persistent-id</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
1 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">surname</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
1 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">uniqueID</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New"">:
1 value(s)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Also the log states that the session was created:<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">2013-08-20 15:46:44 INFO Shibboleth.SessionCache [6]: new session created: ID (_<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana","sans-serif"">9582827607e3554a4fc8b9da0d15b12c) IdP (<a href="https://idp.phlu.ch/idp/shibboleth" target="_blank">https://idp.phlu.ch/idp/shibboleth</a>) Proto<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">col(urn:oasis:names:tc:SAML:2.0:protocol) Address (192.168.23.1)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">2013-08-20 15:46:44 DEBUG Shibboleth.SSO.SAML2 [6]: ACS returning via redirect t<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">o: <a href="https://portal.phlu.dev/phlu.portal/account/authenticate" target="_blank">https://portal.phlu.dev/phlu.portal/account/authenticate</a><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">2013-08-20 15:46:55 DEBUG Shibboleth.Listener [7]: dispatching message (find::St<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">orageService::SessionCache)<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">But in the $_SERVER global variable, there are no traces of a valid Shibboleth session apart from the cookie:<u></u><u></u></span></p>
<pre><span lang="EN-US" style> ["HTTP_COOKIE"]=><u></u><u></u></span></pre>
<pre><span lang="EN-US" style> string(182) "_shibsession_64656661756c7468747470733a2f2f706f7274616c2e70686c752e6465762f73686962626f6c657468=_9582827607e3554a4fc8b9da0d15b12c; TYPO3_Flow_Session=tOfPgzFqptKsQcFewPCt9BJl7mIDj9Cu"<u></u><u></u></span></pre>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">I already turned on logging for Shibboleth (DEBUG level) but found no information about things going wrong. In the Apache log I don’t find any hints, too. Maybe
there are other logs I don’t know (yet) that could help me.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Any help or advice is appreciated.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">My environment:<u></u><u></u></span></b></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Ubuntu 12.10<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Apache 2.2<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">PHP 5.4.6<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Shibboleth SP 2.4.3<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Thanks and best regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif"">Lorenz<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">.......................................................<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt">PH
</span><span style="font-size:10.0pt">Luzern<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Lorenz Ulrich<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Webentwickler<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Löwengraben 14<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">6004 Luzern<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Tel: <a href="tel:%2B41%20%280%2941%20228%2070%2025" value="+41412287025" target="_blank">+41 (0)41 228 70 25</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Web:
<a href="http://www.phlu.ch" target="_blank"><span style="color:blue">www.phlu.ch</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="FR-CH" style="font-size:10.0pt">Mail:
</span><span style="font-size:10.0pt"><a href="mailto:lorenz.ulrich@phlu.ch" target="_blank"><span lang="FR-CH" style="color:blue">lorenz.ulrich@phlu.ch</span></a></span><span style="font-size:10.0pt">
<span lang="FR-CH"><u></u><u></u></span></span></p>
<p class="MsoNormal"><span lang="FR-CH" style="font-size:10.0pt">.......................................................<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Erreichbarkeit: Di, Fr<u></u><u></u></span></p>
</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div style="margin-left:40px">
Karla Borecky<br>Systems Administrator<br>ITS<br>Smith College<br>Northampton, MA 01063<br></div>
</div>