<html><head></head><body><div>I managed to get it working!</div><div><br></div><div>Thanks for the tips, it turns out the reason it was failing at that part was the attribute-filter wasn't quite refined right, hence the attribute wasn't passed as part of that.</div><div><br></div><div>With that working though, there were a couple shortcuts I made that I'd like to fix. The first one being the mail attribute definition. I see it's set to construct that from the uid and add a domain of your choosing, but I was hoping to get that pulled straight from LDAP. Is there a way to do that? I had tried the following, but it didn't work.</div><div><br></div><div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><resolver:AttributeDefinition id="mail" xsi:type="ad:Simple"><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><o:p></o:p></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /><o:p></o:p></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"></resolver:AttributeDefinition></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><br></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><br></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">Any thoughts?</p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><br></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">Thanks,</p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);"><br></p><p style="margin: 0in 0in 0.0001pt; font-family: Calibri, sans-serif; color: rgb(0, 0, 0);">Brandon Mckean</p></div><div><br></div><div>On Thu, 2015-06-25 at 18:18 +0200, Peter Schober wrote:</div><blockquote type="cite"><pre>* McKean, Brandon Scott - mckeanbs <<a href="mailto:mckeanbs@jmu.edu">mckeanbs@jmu.edu</a>> [2015-06-25 18:04]:
<blockquote type="cite">
Added this to saml-nameid.properties:
idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
</blockquote>
As Scott said, don't do that.
Instead put it into the SPs SAML metadata.
<blockquote type="cite">
<afp:AttributeFilterPolicy>
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="jmu.maps.arcgis.com" />
<afp:AttributeRule attributeID="principal">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
<afp:AttributeRule attributeID="mail">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
<afp:AttributeRule attributeID="givenName">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
</afp:AttributeFilterPolicy>
</blockquote>
You can remove out the attribute rule for attributeID="principal" (an
artifact from the v2-based ArcGIS documentation, I'm assuming).
Other than that it looks OK, so make sure the account tested with does
in fact have an email address, the IDP is allowed to see it, etc.
-peter
</pre></blockquote></body></html>