<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Byron,<div class=""><br class=""></div><div class="">If you turn the logging to DEBUG for relevant categories — main and ldap, I think — you’ll be able to see exactly which attributes are available at which point in the flow processing.</div><div class=""><br class=""></div><div class="">They could be dropping the attributes on their end, or you could not have the intended attributes populated or readable by this service account, or more.</div><div class=""><br class=""></div><div class="">The only thing I saw that absolutely won’t work is the release rule for “sn”. You’ve got it defined as “surname” rather than “sn”.</div><div class=""><br class=""></div><div class="">Take care,</div><div class="">Nate.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 7, 2016, at 09:48, Byron Sayres <<a href="mailto:bsayres@rcc.mass.edu" class="">bsayres@rcc.mass.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;" class="">
<div class="">
<div class="">
<div class="">
<div class=""><div style="margin: 0in 0in 0.0001pt;" class="">Looking for assistance with a new Shibboleth instance. Authentication is working and seems to be passing to 3rd party. Now my issue is what <font face="Calibri,sans-serif" class="">I</font><font face="Calibri" class="">’</font><font face="Calibri,sans-serif" class=""><font face="Calibri" class="">m
allowing via attribute-filter.xml. The 3rd party wrote me the below email. Any help on decoding what they are saying and how to fix it would be awesome!</font></font></div><div style="margin: 0in 0in 0.0001pt;" class=""><font face="Calibri,sans-serif" class=""><font face="Calibri" class=""><br class="">
</font></font></div><div style="margin: 0in 0in 0.0001pt;" class=""><font face="Calibri,sans-serif" class=""><font face="Calibri" class=""><br class="">
</font></font></div><div style="margin: 0in 0in 0.0001pt;" class=""><font face="Calibri,sans-serif" class=""><font face="Calibri" class="">Email from 3rd </font></font><font face="Calibri" class="">Party: </font></div><div style="margin: 0in 0in 0.0001pt;" class=""><font face="Calibri" class=""><br class="">
</font></div><div style="margin: 0in 0in 0.0001pt;" class=""><font size="2" face="sans-serif" class="">The requested values to map are</font><span style="font-family: -webkit-standard; font-size: 12px;" class=""> </span><br style="font-family: -webkit-standard;" class="">
<tt class=""><font size="2" class="">x-r25-first-name = urn:oid:2.5.4.42<br class="">
x-r25-family-name = urn:oid:2.5.4.4<br class="">
x-r25-email-work = urn:oid:0.9.2342.19200300.100.1.3<br class="">
x-r25-user = urn:oid:1.3.6.1.4.1.5923.1.1.1.6<br class="">
</font></tt><br style="font-family: -webkit-standard;" class="">
<font size="2" face="sans-serif" class="">It looks like there is a miscommunication in the release policy. Here's the info from our auth team</font><span style="font-family: -webkit-standard; font-size: 12px;" class=""> </span><br style="font-family: -webkit-standard;" class="">
<br style="font-family: -webkit-standard;" class="">
<tt class=""><font size="2" class="">they have only asserted one attribute (named "urn:oid:1.3.6.1.4.1.5923.1.1.1.9" (a.k.a. "eduPersonScopedAffiliation"). They are not releasing any of the attributes they have requested us to map. My first guess would be there is an error
in their attribute release policy. One common thing missed is to leave the trailing / off our entity ID.</font></tt></div><div style="margin: 0in 0in 0.0001pt;" class=""><font face="Calibri,sans-serif" class=""><font face="Calibri" class=""><br class="">
</font></font></div><div style="margin: 0in 0in 0.0001pt;" class=""><font face="Calibri,sans-serif" class=""><font face="Calibri" class=""><br class="">
</font></font></div><div style="margin: 0in 0in 0.0001pt;" class=""><font face="Calibri,sans-serif" class=""><font face="Calibri" class=""><br class="">
</font></font></div><div style="margin: 0in 0in 0.0001pt;" class="">Here is my attribute-resolver.xml</div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div>
</div>
<div class=""><div style="margin: 0in 0in 0.0001pt;" class=""><b class="">attribute-resolver.xml</b></div><div style="margin: 0in 0in 0.0001pt;" class=""> <!-- email is Email Address --></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="email" scope="mydomain.dom" sourceAttributeID="mail"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:Dependency ref="ActiveDirectory" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </resolver:AttributeDefinition></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""> <!-- surname is Last Name --></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="surname" scope="mydomain.dom" sourceAttributeID="sn"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:Dependency ref="ActiveDirectory" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </resolver:AttributeDefinition></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""> <!-- givenName is First Name --></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="givenName" scope="mydomain.dom" sourceAttributeID="givenName"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:Dependency ref="ActiveDirectory" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </resolver:AttributeDefinition></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonPrincipalName" scope="mydomain.dom" sourceAttributeID="sAMAccountName"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:Dependency ref="ActiveDirectory" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </resolver:AttributeDefinition></div><div style="margin: 0in 0in 0.0001pt;" class=""><b class=""><br class="">
</b></div><div style="margin: 0in 0in 0.0001pt;" class=""><resolver:DataConnector id="ActiveDirectory" xsi:type="dc:LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span>ldapURL="<a href="ldaps://server.mydomain.dom:636" class="">ldaps://server.mydomain.dom:636</a>"</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span>connectionStrategy="DEFAULT"</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span>baseDN=“dc=mydomain,dc=dom" </div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span>principal=“CN=shibserv,OU=Services,DC=mydomain,DC=dom"</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span>principalCredential=“password"></div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><dc:FilterTemplate></div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><![CDATA[</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span>(sAMAccountName=$requestContext.principalName)</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span>]]></div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span></dc:FilterTemplate></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><ReturnAttributes>sAMAccountName mail givenName sn displayName</ReturnAttributes></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><LDAPProperty name="java.naming.referral" value="follow" /></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span></resolver:DataConnector></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class="">Here is my attribute-filter.xml</div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""><b class="">attribute-filter.xml</b></div><div style="margin: 0in 0in 0.0001pt;" class=""> <afp:AttributeRule attributeID="mail"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </afp:AttributeRule></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="givenName"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </afp:AttributeRule></div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span></p><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="sn"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </afp:AttributeRule></div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span></p><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="sAMAccountName"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </afp:AttributeRule></div><div style="margin: 0in 0in 0.0001pt;" class=""><br class="">
</div><div style="margin: 0in 0in 0.0001pt;" class=""><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="eduPersonScopedAffiliation"></div><div style="margin: 0in 0in 0.0001pt;" class=""> <afp:PermitValueRule xsi:type="basic:ANY" /></div><div style="margin: 0in 0in 0.0001pt;" class=""> </afp:AttributeRule></div>
</div>
</div>
<div class="">
<div id="MAC_OUTLOOK_SIGNATURE" class=""></div>
</div>
</div>
</div>
</div>
-- <br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></div></body></html>