<div dir="ltr">Integrating our IdP with a vendor that makes a SAML authN request, followed by an attribute query for attributes. The attribute query identifies the principal with a qualified name (<a href="mailto:username@alaska.edu">username@alaska.edu</a>) as a "transient identifier" rather than username we use to authenticate and find records in our directories. The result is an empty result for the attribute query. <div><br></div><div>This is the first and only attribute query I've encountered; is there an obvious way to configure the IdP to successfully return attributes? I suppose the transient identifier is from the principal in the authN SAML assertion, which the vendor specified as being a scoped, <a href="mailto:username@alaska.edu">username@alaska.edu</a>.<br><div><br></div><div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">09:30:17.737 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:543] - Resolving principal name for subject of SAML request '_2D6CB1BEF5FAE0BF8758C932ADCE5833' from relying party '<a href="https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt">https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt</a>'<br></span><span class="">09:30:17.737 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:555] - Error resolving principal name for SAML request '_2D6CB1BEF5FAE0BF8758C932ADCE5833' from relying party '<a href="https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt">https://sp.transactsp.com/shibboleth-sp/mgmt-ualaska-sp.blackboard.com/mgmt</a>'. Cause: No information associated with transient identifier: dj</span><span class="">dewolfe</span><span class="">@<a href="http://alaska.edu">alaska.edu</a><br></span><span class="">09:30:17.738 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:49] - Beginning encode message to outbound transport of type: org.opensaml.ws.transport.http.HttpServletResponseAdapter<br></span><span class="">09:30:17.738 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPSOAP11Encoder:172] - Building SOAP message...</span></blockquote>
<p class="">David Bantz, U Alaska</p></div></div></div>