<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body><div>Tony,</div><div><br></div><div>I got the commonname and email address flow working. Surname I haven't tried, but, it's literally a one letter difference in configuration from cn.</div><div><br></div><div>The thing that was tripping me up for a while is having to make sure all attributes used in the nameid generation are explicitly allowed to arcgis in attribute-filter.xml</div><div><br></div><div>Here's some examples from mine:</div><div><br></div><div>attribute-filter.xml: (You'd need to add sn here if you want to use that)</div><div><br></div><div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><afp:AttributeFilterPolicy id="releaseToArcGIS"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="JMU.maps.arcgis.com" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><afp:AttributeRule attributeID="cn"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </afp:AttributeRule><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><afp:AttributeRule attributeID="mail"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </afp:AttributeRule><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <afp:AttributeRule attributeID="givenName"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </afp:AttributeRule><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </afp:AttributeFilterPolicy><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">My attribute resolver looks like this:<o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:Dependency ref="jmuad" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </resolver:AttributeDefinition><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><resolver:AttributeDefinition xsi:type="ad:Simple" id="cn" sourceAttributeID="cn"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:Dependency ref="jmuad" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:cn" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.3" friendlyName="cn" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </resolver:AttributeDefinition><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeDefinition xsi:type="ad:Simple" id="givenName" sourceAttributeID="givenName"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:Dependency ref="jmuad" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </resolver:AttributeDefinition><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeDefinition xsi:type="ad:Simple" id="sn" sourceAttributeID="sn"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:Dependency ref="jmuad" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> </resolver:AttributeDefinition><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">Then the saml-nameid.xml: (You could have it source from sn instead if you wanted.)<o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><o:p> </o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><bean parent="shibboleth.SAML2AttributeSourcedGenerator"<o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:eid"<o:p></o:p></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> p:attributeSourceIds="cn" /></p></div><div><br></div><div><br></div><div>Lastly you need to make sure that nameid format is being used for arcgis. I'm currently doing it globally in relying-party.xml since it's a testbox, but the right way would be adding it to the metadata. (I'm just calling it eid at the end because that's what we refer to them here. You could just as easily do uid, cn, sn, etc, you just need to make sure it matches what is set to be sent to them.)</div><div><br></div><div><br></div><div>Hope this helps!</div><div><br></div><div>Brandon McKean</div><div><br></div><div>On Thu, 2015-06-25 at 16:29 -0400, Tony Skalski wrote:</div><blockquote type="cite">Brandon,<div><br></div><div>Are you seeing surname and email address flow into Arcgis.com? We have been able to get the auth to work but unable to get surname and email address working. <span></span><br><br>On Thursday, June 25, 2015, McKean, Brandon Scott - mckeanbs <<a href="mailto:mckeanbs@jmu.edu">mckeanbs@jmu.edu</a>> wrote:<br><blockquote type="cite"><div><div>Thanks for the tip! Turns out I was confused of the use of the config files. I was putting these things in attribute-resolver-ldap.xml rather than attribute-resolver.xml Having put them into the right place they now work as expected.</div><div><br></div><div>Brandon McKean</div><div><br></div><div>On Thu, 2015-06-25 at 21:53 +0200, Peter Schober wrote:</div><blockquote type="cite"><pre>* McKean, Brandon Scott - mckeanbs <<a href="javascript:_e(%7B%7D,'cvml','mckeanbs@jmu.edu');" target="_blank">mckeanbs@jmu.edu</a>> [2015-06-25 21:46]:
<blockquote type="cite">
The first one being the mail attribute definition. I see it's set to
construct that from the uid and add a domain of your choosing, but I
was hoping to get that pulled straight from LDAP. Is there a way to
do that?
</blockquote>
Sure, if the software couldn't pass around email addresses, but only
uids, that would be pretty broken.
<blockquote type="cite">
<resolver:AttributeDefinition id="mail" xsi:type="ad:Simple">
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:mail" encodeType="false" />
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"
encodeType="false" />
</resolver:AttributeDefinition>
</blockquote>
Your previously sent version looked better, as it included
sourceAttributeID="mail" in the AttributeDefinition and a child
element of <resolver:Dependency ref="jmuad" /> referencing the
DataConnector that should be able to provide the "mail" attribute.
They're both missing from your example above.
But do consult the documentation, for IDPv3 it's this (or something in
that vicinity):
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration</a>
-peter
</pre></blockquote></div><br></blockquote></div><br><br><pre>--
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre></blockquote></body></html>