<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi all,<br>
<br>
I am trying to connect our IdP (v2.4) server to InCommon's R&S
Category of SPs and I can log into their test GENI Experimenter
Portal URL here <br>
<br>
<a class="moz-txt-link-freetext" href="https://portal.geni.net/secure/env.php">https://portal.geni.net/secure/env.php</a> <br>
<br>
and I can also log into the test InCommon SP here <br>
<br>
<a class="moz-txt-link-freetext" href="https://service1.internet2.edu/test/">https://service1.internet2.edu/test/</a> <br>
<br>
One thing I noticed though, both give status pages for what
attributes were received and both display my eduPersonPrincipalName
correctly but they are not showing other attributes that I
configured to be released like sn, givenName, mail etc.... I am not
sure if that is by design (they just don't bother showing it)... or
they are not receiving these attributes at all. The changes I made
to the attribute-filter.xml file are as follows and I followed the
directions in this URL
<a class="moz-txt-link-freetext" href="https://spaces.internet2.edu/display/InCFederation/Configure+a+Shibboleth+IdP+to+Release+Directory+Info">https://spaces.internet2.edu/display/InCFederation/Configure+a+Shibboleth+IdP+to+Release+Directory+Info</a><br>
<br>
<afp:AttributeFilterPolicy id="releaseToAnySP"><br>
<afp:PolicyRequirementRule xsi:type="basic:ANY"/><br>
<br>
<afp:AttributeRule
attributeID="eduPersonPrincipalName"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="email"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="displayName"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="givenName"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="surname"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
</afp:AttributeFilterPolicy><br>
<br>
<br>
The only other thing I could think of is if the
attribute-resolver.xml file isn't pulling the right attributes from
Active Directory (you can't release what you don't have). There are
entries in the attribute-resolver.xml file for all the attributes
that are not appearing ... for example..<br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="<b>email</b>"
sourceAttributeID="<b>mail</b>"><br>
<resolver:Dependency ref="<b>myLDAP</b>" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:mail" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" /><br>
</resolver:AttributeDefinition><br>
<br>
and .....<br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="<b>surname</b>"
sourceAttributeID="<b>sn</b>"><br>
<resolver:Dependency ref="<b>myLDAP</b>" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:sn" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.4" friendlyName="sn" /><br>
</resolver:AttributeDefinition><br>
<br>
but I think my LDAP connector might be filtering out everything
except the sAMAccountName (which is used to build the
eduPersonPrincipalName attribute)... here is the section of that
file that names and establishes my LDAP connection to Active
Directory<br>
<br>
<br>
<!-- LDAP Connector - just attach to the AD LDAP --><br>
<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory"
xmlns="urn:mace:shibboleth:2.0:resolver:dc" <br>
useStartTLS="<i>[our-TLS-setting]</i>"<br>
ldapURL="<a class="moz-txt-link-freetext" href="ldap://">ldap://</a><i>[our-AD-server]</i>:<i>[our-port-number]</i>"
baseDN="<i>[our base DN]</i>" principal="<i>[our-user]</i>@wheatonma.edu"<br>
principalCredential="<i>[service-account-password]</i>"><br>
<b> <FilterTemplate></b><b><br>
</b><b> <![CDATA[</b><b><br>
</b><b>
(sAMAccountName=$requestContext.principalName)</b><b><br>
</b><b> ]]></b><b><br>
</b><b> </FilterTemplate></b><br>
<br>
<!-- We rely on the uniqueness of the objectSid. But it
is binary so we *must* make it so --><br>
<LDAPProperty name="java.naming.ldap.attributes.binary"
value="objectSid"/><br>
<!-- If we are following from the GC we need thus on
--><br>
<LDAPProperty name="java.naming.referral"
value="follow"/><br>
</resolver:DataConnector><br>
<br>
<br>
Could that <i>FilterTemplate</i> section highlighted above be
keeping other attributes from being pulled?<br>
<br>
Thanks!<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
++++++++++++++++++++++++++++
Brian Gibson
Systems Administrator
Wheaton College
Are you a musician? If so visit my Arbans Online music site at
<a class="moz-txt-link-freetext" href="http://arbansonline.com">http://arbansonline.com</a> and listen & contribute
</pre>
</body>
</html>