<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi all,<o:p></o:p></p>
<p class="MsoNormal">Kerberos authentication is now working well, and transparently through RemoteUser.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However I’ve now come to try to map some attributes to send and I’m using
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler+-+Attribute+resolver">
https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler+-+Attribute+resolver</a> to do this within attribute-resolver.xml.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Modifying this for my own environment I have:<o:p></o:p></p>
<p class="MsoNormal">------------------------------------------------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal"> <resolver:AttributeDefinition id="principalName"<o:p></o:p></p>
<p class="MsoNormal"> xsi:type="ad:PrincipalName"<o:p></o:p></p>
<p class="MsoNormal"> dependencyOnly="true"><o:p></o:p></p>
<p class="MsoNormal"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <resolver:AttributeDefinition id="krb_principalname"<o:p></o:p></p>
<p class="MsoNormal"> xsi:type="ad:Mapped"<o:p></o:p></p>
<p class="MsoNormal"> sourceAttributeID="principalName"<o:p></o:p></p>
<p class="MsoNormal"> dependencyOnly="true" ><o:p></o:p></p>
<p class="MsoNormal"> <resolver:Dependency ref="principalName" /><o:p></o:p></p>
<p class="MsoNormal"> <ad:ValueMap><o:p></o:p></p>
<p class="MsoNormal"> <ad:ReturnValue>$1</ad:ReturnValue><o:p></o:p></p>
<p class="MsoNormal"> <ad:SourceValue>(.+)@INTERNAL.DOMAIN.AC.UK</ad:SourceValue><o:p></o:p></p>
<p class="MsoNormal"> </ad:ValueMap><o:p></o:p></p>
<p class="MsoNormal"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <resolver:AttributeDefinition id="krb_domain"<o:p></o:p></p>
<p class="MsoNormal"> xsi:type="ad:Mapped"<o:p></o:p></p>
<p class="MsoNormal"> sourceAttributeID="principalName"<o:p></o:p></p>
<p class="MsoNormal"> dependencyOnly="true" ><o:p></o:p></p>
<p class="MsoNormal"> <resolver:Dependency ref="principalName" /><o:p></o:p></p>
<p class="MsoNormal"> <ad:ValueMap><o:p></o:p></p>
<p class="MsoNormal"> <ad:ReturnValue>internal.uwic.ac.uk</ad:ReturnValue><o:p></o:p></p>
<p class="MsoNormal"> <ad:SourceValue>(.+)@INTERNAL.DOMAIN.AC.UK</ad:SourceValue><o:p></o:p></p>
<p class="MsoNormal"> </ad:ValueMap><o:p></o:p></p>
<p class="MsoNormal"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <resolver:DataConnector id="myLDAP"<o:p></o:p></p>
<p class="MsoNormal"> xsi:type="dc:LDAPDirectory"<o:p></o:p></p>
<p class="MsoNormal"> ldapURL="ldap://ldap.internal.domain.ac.uk"<o:p></o:p></p>
<p class="MsoNormal"> baseDN="ou=User Accounts,dc=internal,dc=domain,dc=ac,dc=uk"<o:p></o:p></p>
<p class="MsoNormal"> principal="<a href="mailto:shib@internal.domain.ac.uk">shib@internal.domain.ac.uk</a>"<o:p></o:p></p>
<p class="MsoNormal"> principalCredential="password"><o:p></o:p></p>
<p class="MsoNormal"> <resolver:Dependency ref="krb_principalname" /><o:p></o:p></p>
<p class="MsoNormal"> <resolver:Dependency ref="krb_domain" /><o:p></o:p></p>
<p class="MsoNormal"> <dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"><!--<o:p></o:p></p>
<p class="MsoNormal">(mail=$requestContext.principalName) - matches UsernamePassword Principal<o:p></o:p></p>
<p class="MsoNormal">&(samaccountname=${})(msSFU30NisDomain=${}) - matches Kerberos Principal<o:p></o:p></p>
<p class="MsoNormal">--><o:p></o:p></p>
<p class="MsoNormal"> <![CDATA[<o:p></o:p></p>
<p class="MsoNormal"> (&(|(mail=$requestContext.principalName)(&(samaccountname=${krb_principalname.get(0)})(msSFU30NisDomain=${krb_domain.get(0)})))(objectclass=user))<o:p></o:p></p>
<p class="MsoNormal"> ]]><o:p></o:p></p>
<p class="MsoNormal"> </dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <dc:LDAPProperty name="java.naming.referral" value="follow"/><o:p></o:p></p>
<p class="MsoNormal"> </resolver:DataConnector><o:p></o:p></p>
<p class="MsoNormal">------------------------------------------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal">Debug output shows:<o:p></o:p></p>
<p class="MsoNormal">----------------------------------------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal">15:05:25.103 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:478] - Resolving attributes for principal 'username@INTERNAL.DOMAIN.AC.UK' for SAML request from relying party 'https://sp.testshib.org/shibboleth-sp'<o:p></o:p></p>
<p class="MsoNormal">15:05:25.103 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:119] - shibboleth.AttributeResolver resolving attributes for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.103 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> were not requested, resolving all attributes.<o:p></o:p></p>
<p class="MsoNormal">15:05:25.103 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute eduPersonScopedAffiliation for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.103 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:354] - Resolving data connector myLDAP for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.104 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute krb_principalname for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.104 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute principalName for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.104 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:25.104 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.MappedAttributeDefinition:97] - Attribute Definition krb_principalname: mapping depdenency attribute value
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.104 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:84] - Attempting to map attribute value 'username@INTERNAL.DOMAIN.AC.UK'<o:p></o:p></p>
<p class="MsoNormal">15:05:25.105 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:99] - Performing regular expression based comparison<o:p></o:p></p>
<p class="MsoNormal">15:05:25.106 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:105] - Attribute value 'username@INTERNAL.DOMAIN.AC.UK' matches regular expression it will be mapped to 'username'<o:p></o:p></p>
<p class="MsoNormal">15:05:25.106 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.MappedAttributeDefinition:119] - Attribute Definition krb_principalname: mapped depdenency attribute value
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> to the values [username]<o:p></o:p></p>
<p class="MsoNormal">15:05:25.106 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_principalname containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:25.106 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute krb_domain for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.106 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:25.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.MappedAttributeDefinition:97] - Attribute Definition krb_domain: mapping depdenency attribute value
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:84] - Attempting to map attribute value 'username@INTERNAL.DOMAIN.AC.UK'<o:p></o:p></p>
<p class="MsoNormal">15:05:25.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:99] - Performing regular expression based comparison<o:p></o:p></p>
<p class="MsoNormal">15:05:25.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:105] - Attribute value 'username@INTERNAL.DOMAIN.AC.UK' matches regular expression it will be mapped to 'internal.DOMAIN.ac.uk'<o:p></o:p></p>
<p class="MsoNormal">15:05:25.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.MappedAttributeDefinition:119] - Attribute Definition krb_DOMAIN: mapped depdenency attribute value
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> to the values [internal.DOMAIN.ac.uk]<o:p></o:p></p>
<p class="MsoNormal">15:05:25.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:25.109 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter: (&(|(<a href="mailto:mail=username@INTERNAL.DOMAIN.AC.UK)(&(samaccountname=username)(msSFU30Nisdomain=internal.domain.ac.uk)))(objectclass=user))">mail=username@INTERNAL.DOMAIN.AC.UK)(&(samaccountname=username)(msSFU30Nisdomain=internal.domain.ac.uk)))(objectclass=user))</a><o:p></o:p></p>
<p class="MsoNormal">15:05:25.109 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363] - LDAP data connector myLDAP - Retrieving attributes from LDAP<o:p></o:p></p>
<p class="MsoNormal">15:05:30.118 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute eduPersonScopedAffiliation containing 0 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.118 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute transientId for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.119 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:97] - Building transient ID for request _75254f2685bd3e67f7856ebaf4b93743; outbound message
issuer: <a href="https://idp.dev.cardiffmet.ac.uk/idp/shibboleth">https://idp.dev.cardiffmet.ac.uk/idp/shibboleth</a>, inbound message issuer:
<a href="https://sp.testshib.org/shibboleth-sp">https://sp.testshib.org/shibboleth-sp</a>, principal identifer:
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.119 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:115] - Created transient ID _5f54a61906da93f401e5905676bf8874 for request _75254f2685bd3e67f7856ebaf4b93743<o:p></o:p></p>
<p class="MsoNormal">15:05:30.119 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute transientId containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.119 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute eduPersonTargetedID for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.119 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:354] - Resolving data connector computedID for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.119 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.120 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_principalname containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.120 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.121 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.121 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ComputedIDDataConnector:121] - Source attribute sAMAccountName for connector computedID provide no values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.121 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute eduPersonTargetedID containing 0 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.121 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.121 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_principalname containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.122 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute eduPersonPrincipalName for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.122 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.122 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_principalname containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.122 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.126 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.126 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute eduPersonPrincipalName containing 0 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.127 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.129 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute principalName containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.129 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN containing 1 values<o:p></o:p></p>
<p class="MsoNormal">15:05:30.129 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:455] - Removing attribute eduPersonScopedAffiliation from resolution result for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>. It contains no values.<o:p></o:p></p>
<p class="MsoNormal">15:05:30.130 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:473] - Attribute transientId has 1 values after post-processing<o:p></o:p></p>
<p class="MsoNormal">15:05:30.130 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:455] - Removing attribute eduPersonTargetedID from resolution result for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>. It contains no values.<o:p></o:p></p>
<p class="MsoNormal">15:05:30.130 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:447] - Removing dependency-only attribute krb_principalname from resolution result for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>.<o:p></o:p></p>
<p class="MsoNormal">15:05:30.130 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:455] - Removing attribute eduPersonPrincipalName from resolution result for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>. It contains no values.<o:p></o:p></p>
<p class="MsoNormal">15:05:30.130 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:447] - Removing dependency-only attribute principalName from resolution result for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>.<o:p></o:p></p>
<p class="MsoNormal">15:05:30.130 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:447] - Removing dependency-only attribute krb_DOMAIN from resolution result for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>.<o:p></o:p></p>
<p class="MsoNormal">15:05:30.131 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:137] - shibboleth.AttributeResolver resolved, for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>, the attributes: [transientId]<o:p></o:p></p>
<p class="MsoNormal">15:05:30.131 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:71] - shibboleth.AttributeFilterEngine filtering 1 attributes for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.131 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy releaseTransientIdToAnyone is active for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.132 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:139] - Filter policy releaseTransientIdToAnyone is active for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.135 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute transientId for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.135 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy releaseBasicAttributesToAnyone is active for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.135 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:139] - Filter policy releaseBasicAttributesToAnyone is active for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.138 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute eduPersonScopedAffiliation for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.138 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute eduPersonAffiliation for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.138 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:163] - Processing permit value rule for attribute eduPersonTargetedID for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><o:p></o:p></p>
<p class="MsoNormal">15:05:30.138 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:109] - Attribute transientId has 1 values after filtering<o:p></o:p></p>
<p class="MsoNormal">15:05:30.138 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:114] - Filtered attributes for principal
<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>. The following attributes remain: [transientId]<o:p></o:p></p>
<p class="MsoNormal">15:05:30.139 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:505] - Creating attribute statement in response to SAML request '_75254f2685bd3e67f7856ebaf4b93743' from relying party 'https://sp.testshib.org/shibboleth-sp'<o:p></o:p></p>
<p class="MsoNormal">15:05:30.139 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:263] - Attribute transientId was not encoded (filtered by query, or no SAML2AttributeEncoder attached).<o:p></o:p></p>
<p class="MsoNormal">15:05:30.139 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:129] - No attributes remained after encoding and filtering by value, no attribute statement built<o:p></o:p></p>
<p class="MsoNormal">------------------------------------------------------------------------------------------------------------------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can see that the krb_principalname and krb_domain get mapped to the correct parts of the principal, but I’m having trouble then passing that to the LDAP connector. I think it’s something up with the search filter.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Can anybody please point me in the right direction here:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
<p class="MsoNormal">Andi<o:p></o:p></p>
</div>
</body>
</html>