<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Peter,
<div><br>
</div>
<div>Thank you. I had to configure the SP to accept the other attributes in attribute-map.xml.</div>
<div><br>
</div>
<div>Sam</div>
<div><br>
</div>
<div><br>
<div>
<div>On Apr 3, 2014, at 3:47 PM, Peter Schober wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div>Not fully clear what you're asking. I'm guessing it's "I run both a<br>
Shib IDP and Shib SP and I'm trying to pass attributes from the former<br>
to the latter, but some are not making it through"?<br>
<br>
* Sam Agnew <<a href="mailto:saa2012@qatar-med.cornell.edu">saa2012@qatar-med.cornell.edu</a>> [2014-04-03 13:54]:<br>
<blockquote type="cite">We are trying to establish how to pass metadata in our test<br>
</blockquote>
<blockquote type="cite">Shibboleth setup. We expect to be joining inCommon when we go<br>
</blockquote>
<blockquote type="cite">production so we have set up a test AD with the eduPerson schema<br>
</blockquote>
<blockquote type="cite">added.<br>
</blockquote>
<br>
Fyi, metadata is something else in SAML, you're talking about data (or<br>
"attributes", more commonly).<br>
<br>
<blockquote type="cite">Also we are asking for some POSIX attributes like:<br>
</blockquote>
<br>
Asking how? "We" is the SAML SP here? And you're asking the SAML IDP<br>
to send certain attributes? Does the IDP have all desired attributes<br>
available from LDAP (if not that's what needs fixing). The IDP's log<br>
files will tell you what the IDP has available and what not (mybe<br>
increasing the log level to DEBUG for e.g.<br>
edu.internet2.middleware.shibboleth.common.attribute.resolver.provider<br>
for the attribute resolver, or<br>
edu.internet2.middleware.shibboleth.common.attribute.filtering.provider<br>
for the attribute filter).<br>
<br>
<blockquote type="cite">We are receiving a mixed bag and I'm feeling like there's something<br>
</blockquote>
<blockquote type="cite">I'm not quite understanding. We receive:<br>
</blockquote>
<br>
Recieve from whom? When you (as the SAML SP) don't recieve what you<br>
expect that's for you to take up with the issuer of that data (the<br>
SAML IDP), but first make sure you really don't recieve it but<br>
checking the SP's log files (see below).<br>
<br>
<blockquote type="cite">We receive an eppn (eduPersonPrincipalName?) which is not the<br>
</blockquote>
<blockquote type="cite">populated value but rather the sAMAccountName+@+dnssuffix<br>
</blockquote>
<br>
What is the populated value then? Also check the spec so you know what<br>
to expect, <a href="http://macedir.org/specs/eduperson/">http://macedir.org/specs/eduperson/</a><br>
What you got above seems like something I would expect to recieve.<br>
<br>
<blockquote type="cite">We receive an unscoped-affiliation which appears to be the value for eduPersonAffiliation<br>
</blockquote>
<blockquote type="cite">We get nothing for uid<br>
</blockquote>
<blockquote type="cite">We get nothing for eduPersonNickname<br>
</blockquote>
<blockquote type="cite">We get nothing for eduPersonPrimaryAffiliation<br>
</blockquote>
<br>
<blockquote type="cite">I can see all the values being asked for:<br>
</blockquote>
<blockquote type="cite">12:26:37.859 - INFO [Shibboleth-Audit:1028] - 20140403T092637Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_08ae5fccee401616aa52a038eb6aa180|https://sp.qatar-med.cornell.edu/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.qatar-med.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_c5a9e00627597559c401066471b214c3|student2013|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,eduPersonPrincipalName,eduPersonAffiliation,eduPersonPrimaryAffiliation,surname,givenName,eduPersonNickname,commonName,transientId,email,displayName,|_4e803ba53b7bd0e909551a8ef7e6b138||<br>
</blockquote>
<br>
These are not the values "being asked for", these are the values<br>
*sent* by that IDP as far as the IDP is concerned. If you don't<br>
"receive" them on the SP side check the SP's log files, e.g. look for<br>
"skipping" in shibd.log<br>
Note that by default the Shib SP will only map eduPerson attributes<br>
and ignore all others. You'd need to uncomment the existing<br>
definitions (using the urn:oid syntax, as you're usingn SAML2 above)<br>
in your SP's attribute-map.xml<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
</div>
<br>
<div><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; ">
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; "><br class="Apple-interchange-newline">
--</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">Sam Agnew</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">
System Administrator</div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">IT Department</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">Weill Cornell Medical College in Qatar</font></div>
<div><br class="webkit-block-placeholder">
</div>
</span><br class="Apple-interchange-newline">
</div>
<br>
</div>
</body>
</html>