<div dir="ltr">Andrew,<div><br></div><div>Thanks so much for the clarification. Apparently I had the NameID coming across through a different attribute. My issue was a malformed email attribute that I needed to scope properly (it's a scripted attribute built from our UIDs... long story). Either way, your reply helped me understand and address the issue properly.</div><div><br></div><div>I do have one more questions, if I may. How are you creating the "<font face="monospace, monospace">modifytimestamp</font>" attribute that you reference?</div><div><br></div><div><font face="monospace, monospace"><span style="font-size:12.8px"><resolver:AttributeDefinition xsi:type="ad:Simple" id="webex_updatetimestamp" sourceAttributeID="modifytimes</span><span style="font-size:12.8px">tamp"></span><br style="font-size:12.8px"><span style="font-size:12.8px"> <resolver:Dependency ref="ONIDLDAP" /></span><br style="font-size:12.8px"><span style="font-size:12.8px"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="updateTimeStamp" /></span><br style="font-size:12.8px"><span style="font-size:12.8px"></resolver:AttributeDefinition</span><span style="font-size:12.8px">></span></font><br></div><div><br></div><div>Thanks again!</div><div>Teddy</div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><b><br></b></div><div dir="ltr"><b>Tadeusz Sacilowski</b><div><i style="font-size:small">Enterprise Architect & Security Engineer</i><i><br></i></div><div>Teachers College, Columbia University</div><div><a href="mailto:ts2878@tc.columbia.edu" target="_blank">ts2878@tc.columbia.edu</a></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Nov 5, 2015 at 12:35 PM, Andrew Morgan <span dir="ltr"><<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Thu, 5 Nov 2015, Sacilowski, Tadeusz wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi All,<br>
<br>
So I'm still having some issues with the WebEx auto account creation. The<br>
error message on the WebEx side shows "Auto Account Creation failed (31)".<br>
I've added the following to my attribute.resolver.xml:<br>
<br>
<!-- BEGIN: Attributes for WebEx auto account creation --><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExUid"<br>
sourceAttributeID="uid"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"<br>
name="uid" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExFirstname"<br>
sourceAttributeID="givenName"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"<br>
name="firstname" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExLastname"<br>
sourceAttributeID="sn"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"<br>
name="lastname" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="WebExEmail"<br>
sourceAttributeID="mail"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>
nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"<br>
name="email" /><br>
</resolver:AttributeDefinition><br>
<!-- END: Attributes for WebEx auto account creation --><br>
<br>
And I'm releasing them to WebEx as such (we will have multiple WebEx sites,<br>
hence the "basic:OR" for AttributeRequesterString):<br>
<br>
<!-- Release WebEx attributes --><br>
<afp:AttributeFilterPolicy id="releaseToWebEx"><br>
<afp:PolicyRequirementRule xsi:type="basic:OR"><br>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<br>
<a href="http://www.webex.com" rel="noreferrer" target="_blank">http://www.webex.com</a>" /><br>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<br>
<a href="https://www.webex.com" rel="noreferrer" target="_blank">https://www.webex.com</a>" /><br>
</afp:PolicyRequirementRule><br>
<br>
<afp:AttributeRule attributeID="WebExUid"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<br>
<afp:AttributeRule attributeID="WebExFirstname"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<br>
<afp:AttributeRule attributeID="WebExLastname"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<br>
<afp:AttributeRule attributeID="WebExEmail"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
</afp:AttributeFilterPolicy><br>
<br>
I see the values being populated in my logs... not sure what I'm doing<br>
wrong. Hoping maybe someone might have some insight as I wait for a<br>
response from their support folks.<br>
</blockquote>
<br></div></div>
You are setting a nameFormat on all of the attributes, but none of them are being encoded as a NameID. You only need the nameFormat on the attribute you are encoding as a NameID.<br>
<br>
Here is OSU's working configuration (with 2 webex sites, btw).<br>
<br>
attribute-resolver.xml:<br>
<br>
<!-- WebEx NameID attribute --><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex-principal" sourceAttributeID="eduPersonPrincipalName"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/><br>
</resolver:AttributeDefinition><br>
<br>
<!-- WebEx attributes --><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex_uid" sourceAttributeID="uid"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="uid" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex_firstname" sourceAttributeID="givenName"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="firstname" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex_lastname" sourceAttributeID="sn"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="lastname" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex_email" sourceAttributeID="eduPersonPrincipalName"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="email" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="webex_updatetimestamp" sourceAttributeID="modifytimestamp"><br>
<resolver:Dependency ref="ONIDLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="updateTimeStamp" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Script" id="webex_affiliation"><br>
<resolver:Dependency ref="ismemberof" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="webex_affiliation" /><br>
<ad:Script><br>
<![CDATA[<br>
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);<br>
webex_affiliation = new BasicAttribute("webex_affiliation");<br>
if (typeof ismemberof != "undefined" && ismemberof != null) {<br>
for (var i=0; i<ismemberof.getValues().size(); i++) {<br>
var group = ismemberof.getValues().get(i);<br>
if (group.toLowerCase() == "cn=staff,ou=webex,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=<a href="http://orst.edu" rel="noreferrer" target="_blank">orst.edu</a>") {<br>
webex_affiliation.getValues().add('staff');<br>
}<br>
if (group.toLowerCase() == "cn=students,ou=webex,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=<a href="http://orst.edu" rel="noreferrer" target="_blank">orst.edu</a>") {<br>
webex_affiliation.getValues().add('students');<br>
}<br>
}<br>
}<br>
]]><br>
</ad:Script><br>
</resolver:AttributeDefinition><br>
<br>
<br>
attribute-filter.xml:<br>
<br>
<!-- WebEx filters --><br>
<afp:AttributeFilterPolicy id="webex-deny-transientid"><span class=""><br>
<afp:PolicyRequirementRule xsi:type="basic:OR"><br></span>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://oregonstate-staff.webex.com" rel="noreferrer" target="_blank">https://oregonstate-staff.webex.com</a>" /><br>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://oregonstate-students.webex.com" rel="noreferrer" target="_blank">https://oregonstate-students.webex.com</a>" /><br>
</afp:PolicyRequirementRule><br>
<afp:AttributeRule attributeID="transientId"><br>
<afp:DenyValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
</afp:AttributeFilterPolicy><br>
<br>
<afp:AttributeFilterPolicy id="webex-staff"><br>
<afp:PolicyRequirementRule xsi:type="basic:AND"><br>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://oregonstate-staff.webex.com" rel="noreferrer" target="_blank">https://oregonstate-staff.webex.com</a>" /><br>
<basic:Rule xsi:type="basic:AttributeValueString" attributeID="webex_affiliation" value="staff" /><br>
</afp:PolicyRequirementRule><br>
<afp:AttributeRule attributeID="webex-principal"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_uid"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_firstname"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_lastname"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_email"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_updatetimestamp"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
</afp:AttributeFilterPolicy><br>
<br></span>
<afp:AttributeFilterPolicy id="webex-students"><br>
<afp:PolicyRequirementRule xsi:type="basic:AND"><br>
<basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://oregonstate-students.webex.com" rel="noreferrer" target="_blank">https://oregonstate-students.webex.com</a>" /><br>
<basic:Rule xsi:type="basic:AttributeValueString" attributeID="webex_affiliation" value="students" /><br>
</afp:PolicyRequirementRule><br>
<afp:AttributeRule attributeID="webex-principal"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_uid"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_firstname"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_lastname"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_email"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br></span>
<afp:AttributeRule attributeID="webex_updatetimestamp"><span class=""><br>
<afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br>
</afp:AttributeFilterPolicy><br>
<br>
<br></span>
I'm happy to help! Ask questions. :)<br>
<br>
Andy<div class="HOEnZb"><div class="h5"><br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>