<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">"Specific attributes ... were not requested" means that the authentication request from the SP does not contain a list of attributes. This is normal, which is why the message is only at DEBUG level. It's not an error.”<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’m confused by this statement the SSOProfileHandler.completeAuthentication eventually calls ShibbolethSAML2AttributeAuthority->getAttributes which as the following
code:<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> </span><span style="font-size:10.0pt;font-family:Consolas;color:#3F7F5F">// get attributes from the message</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> Set<String> queryAttributeIds = getAttributeIds(requestContext.getInboundSAMLMessage());</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> requestedAttributes.addAll(queryAttributeIds);</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><span style="font-size:10.0pt;font-family:Consolas;color:#3F7F5F">// get attributes from metadata</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> Set<String> metadataAttributeIds = getAttribtueIds(requestContext.getPeerEntityMetadata());</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black"> requestedAttributes.addAll(metadataAttributeIds);</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">My understanding of reading this is that the AttributeResolver should get the requested attributes both from the incoming request and the metadata. I am assuming
that further in the resolution process in the ShibbolethSAML2AttributeAuthority->resolveAttributes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> Collection<String> attributeIDs = resolutionContext.getAttributeRequestContext().getRequestedAttributesIds();</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> Map<String,
<u>BaseAttribute</u>> resolvedAttributes = </span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">new</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> HashMap<String,
<u>BaseAttribute</u>>();</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><span style="font-size:10.0pt;font-family:Consolas;color:#3F7F5F">// if no attributes requested, then resolve everything</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">if</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> (attributeIDs ==
</span><b><span style="font-size:10.0pt;font-family:Consolas;color:#7F0055">null</span></b><span style="font-size:10.0pt;font-family:Consolas;color:black"> || attributeIDs.isEmpty()) {</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black">
</span><span style="font-size:10.0pt;font-family:Consolas;color:#0000C0">log</span><span style="font-size:10.0pt;font-family:Consolas;color:black">.debug(</span><span style="font-size:10.0pt;font-family:Consolas;color:#2A00FF">"Specific attributes for principal
{} were not requested, resolving all attributes."</span><span style="font-size:10.0pt;font-family:Consolas;color:black">,</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> resolutionContext.getAttributeRequestContext().getPrincipalName());</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Consolas;color:black"> attributeIDs = getAttributeDefinitions().keySet();</span><span style="font-size:10.0pt;font-family:Consolas"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Consolas;color:black"> }</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">That the getRequestedAttributesIds method returns the requested attributes retrieved from the incoming request and metadata. Am I mistaken? My understanding
of reading the code is that it will first filter the attributes by what is requested in the incoming request and metadata and also by the filter policy configured in the IdP.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Nicholas<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Ian Young<br>
<b>Sent:</b> Thursday, December 26, 2013 6:48 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: RequestedAttributes in SP metada<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On 24 Dec 2013, at 20:45, Nick Amon <<a href="mailto:namon@xceedium.com">namon@xceedium.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">After successful authentication, I noticed this in the logs:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">20:20:51.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal XXX were
not requested, resolving all attributes.</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">As if the AttributeResolver did not recognize that the SP’s RequestedAttribute.<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That's not what the message means.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">"Specific attributes ... were not requested" means that the authentication request from the SP does not contain a list of attributes. This is normal, which is why the message is only at DEBUG level. It's not an error.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The consequence is that the IdP will resolve all attributes it is configured for, and then filter them according to the configured attribute release policy. Again, this is normal behaviour. You control the attributes you want the IdP to
release to a given SP by changing the policy, not in general by changing the metadata.<o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><br>
<span class="apple-tab-span"> </span>-- Ian<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Original Message:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The Amazon SP metadata originally contained the following:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true"><o:p></o:p></p>
<p class="MsoNormal"> <md:AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://signin.aws.amazon.com/saml">https://signin.aws.amazon.com/saml</a>"><o:p></o:p></p>
<p class="MsoNormal"> <ServiceName xml:lang="en">AWS Management Console Single Sign-On</ServiceName><o:p></o:p></p>
<p class="MsoNormal"> <RequestedAttribute isRequired="true" name="<a href="https://aws.amazon.com/SAML/Attributes/Role">https://aws.amazon.com/SAML/Attributes/Role</a>" FriendlyName="RoleEntitlement"/><o:p></o:p></p>
<p class="MsoNormal"> <RequestedAttribute isRequired="true" name="<a href="https://aws.amazon.com/SAML/Attributes/RoleSessionName">https://aws.amazon.com/SAML/Attributes/RoleSessionName</a>" FriendlyName="RoleSessionName"/><o:p></o:p></p>
<p class="MsoNormal"> <RequestedAttribute isRequired="false" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"/><o:p></o:p></p>
<p class="MsoNormal"></md:AssertionConsumerService><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After successful authentication, I noticed this in the logs:<o:p></o:p></p>
<p class="MsoNormal"><b>20:20:51.810 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal XXX were not requested, resolving all attributes.<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As if the AttributeResolver did not recognize that the SP’s RequestedAttribute. I thought that this was caused by AWS not conforming to the SAML standard since I couldn’t find an example of including RequestedAttribute elements inside
AssertionConsumerService elements.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I thus modified the metadata to conform to the standard as I have understood it:<o:p></o:p></p>
<p class="MsoNormal"> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true"><o:p></o:p></p>
<p class="MsoNormal"> <md:AttributeConsumingService index="1"><o:p></o:p></p>
<p class="MsoNormal"> <ServiceName xml:lang="en">AWS Management Console Single Sign-On</ServiceName><o:p></o:p></p>
<p class="MsoNormal"> <RequestedAttribute isRequired="true" name="<a href="https://aws.amazon.com/SAML/Attributes/Role">https://aws.amazon.com/SAML/Attributes/Role</a>" FriendlyName="RoleEntitlement"/><o:p></o:p></p>
<p class="MsoNormal"> <RequestedAttribute isRequired="true" name="<a href="https://aws.amazon.com/SAML/Attributes/RoleSessionName">https://aws.amazon.com/SAML/Attributes/RoleSessionName</a>" FriendlyName="RoleSessionName"/><o:p></o:p></p>
<p class="MsoNormal"> <RequestedAttribute isRequired="false" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"/><o:p></o:p></p>
<p class="MsoNormal"> </md:AttributeConsumingService><o:p></o:p></p>
<p class="MsoNormal">….<o:p></o:p></p>
<p class="MsoNormal">This didn’t work either; I received the exact same message. I therefore looked at the code and it appears it is looking for requested attributes in the AttributeAuthorityDescriptor element. What am I missing? I would like the IdP to
recognize the attributes requested by the SP, ideally in the AssertionConsumerService element so I don’t have to modify the provided metadata, or at the least AttributeConsumingService.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nicholas<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>