<div dir="ltr"><div>I'm trying to get my ldap database associated with the users in the salesforce account, but no identifying information is being sent up with the assertion. The Subject, NameID is a random transient value, and I couldn't figure out how to make it a persistent hash of user data. I tried changing saml-nameid.xml and saml-nameid.properties with no results, the entire NameID block would disappear from the assertion if I tried changing it.</div><div><br></div><div>Below is what I think the relevant files and fields for adding an attribute to the assertion, in my case the user's email. But I am seeing no effect. The logs look like it is getting the 'mail' attribute or at least parses the configuration properly, but I the array for included attributes is empty.</div><div><br></div><div>Does anyone notice something I'm doing wrong, or have an idea of how I can get this working? Thanks for any input and advice.</div><div><b><br></b></div><div><b><br></b></div><div><b>attribute-resolver.xml</b></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><<span class="">resolver</span><span class="">:</span>AttributeDefinition <span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"ad:Simple"</span> <span class="">id</span><span class="">=</span><span class="">"mail"</span>><span class=""> </span> </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> <<span class="">resolver</span><span class="">:</span>Dependency <span class="">ref</span><span class="">=</span><span class="">"myLDAP"</span> /><br><span class=""> </span><resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /><span class=""><br></span><span class=""> </span></<span class="">resolver</span><span class="">:</span>AttributeDefinition> <br> <br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"><br> <dc:FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </dc:FilterTemplate><br> <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked"><br> <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><br> </dc:StartTLSTrustCredential><br> </resolver:DataConnector></blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><<span class="">resolver</span><span class="">:</span>AttributeDefinition <span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"ad:Simple"</span> <span class="">id</span><span class="">=</span><span class="">"mail"</span>><br></blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br></blockquote><div><br></div><div><b>attribute-filter.xml</b> </div><div><br></div><div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><<span class="">afp</span><span class="">:</span>AttributeFilterPolicy <span class="">id</span><span class="">=</span><span class="">"example1"</span>><br><span class=""> </span><span class=""><</span><span class="">afp</span><span class="">:</span><span class="">PolicyRequirementRule </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span>"basic:AttributeRequesterString"<span class=""> </span><span class="">value</span><span class="">=</span>"<a href="https://xxxxxxx.my.salesforce.com.org">https://xxxxxxx.my.salesforce.com.org</a>"<span class=""> /><br></span> <<span class="">afp</span><span class="">:</span>AttributeRule <span class="">attributeID</span><span class="">=</span><span class="">"mail"</span>><br><span class=""> </span><<span class="">afp</span><span class="">:</span>PermitValueRule <span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"basic:ANY"</span> /><br><span class=""> </span></<span class="">afp</span><span class="">:</span>AttributeRule><br></<span class="">afp</span><span class="">:</span>AttributeFilterPolicy></blockquote><div><br></div><div> <b>relying-party.xml</b></div><div><b><br></b></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""><</span><span class="">util</span><span class="">:</span><span class="">list </span><span class="">id</span><span class="">=</span>"shibboleth.RelyingPartyOverrides"><br> <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://xxxxxxx.my.salesforce.com">https://xxxxxxx.my.salesforce.com</a>"><br> <property name="profileConfigurations"><br> <list><br> <bean parent="SAML2.SSO" p:encryptAssertions="false" p:postAuthenticationFlows="attribute-release" p:includeAttributeStatement="true" /><br> </list><br> </property><br></bean></blockquote><div><br></div><div><b>idp-process.log</b></div><div><br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">2015-10-27 13:28:13,280 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:172] - Service 'shibboleth.AttributeResolverService': Performing initial load<br>2015-10-27 13:28:13,280 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:258] - Service 'shibboleth.AttributeResolverService': Reloading service configuration<br>2015-10-27 13:28:13,286 - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [~/shibboleth-idp/conf/attribute-resolver.xml]<br>2015-10-27 13:28:13,414 - INFO [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:58] - Parsing configuration for AttributeDefinition plugin with id : mail<br>2015-10-27 13:28:13,415 - INFO [net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:52] - Parsing configuration for Dependency with pluginId : myLDAP<br>2015-10-27 13:28:13,438 - INFO [net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:58] - Parsing configuration for DataConnector plugin with id : myLDAP<br>2015-10-27 13:28:13,488 - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:510] - Refreshing ApplicationContext:shibboleth.AttributeResolverService: startup date [Tue Oct 27 13:28:13 UTC 2015]; parent: Root WebApplicationContext<br>2015-10-27 13:28:13,944 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:378] - Service 'shibboleth.AttributeResolverService': Completed reload and swapped in latest configuration for service 'shibboleth.AttributeResolverService' </blockquote><div>.....</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">2015-10-27 13:28:16,661 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:135] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers [] </blockquote>
<div>
</div>
<p class=""><span class="">
</span></p></div></div>