<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;">Looking for assistance with a new Shibboleth instance. Authentication is working and seems to be passing to 3rd party. Now my issue is what <font face="Calibri,sans-serif">I</font><font face="Calibri">’</font><font face="Calibri,sans-serif"><font face="Calibri">m
allowing via attribute-filter.xml. The 3rd party wrote me the below email. Any help on decoding what they are saying and how to fix it would be awesome!</font></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font face="Calibri,sans-serif"><font face="Calibri"><br>
</font></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font face="Calibri,sans-serif"><font face="Calibri"><br>
</font></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font face="Calibri,sans-serif"><font face="Calibri">Email from 3rd </font></font><font face="Calibri">Party: </font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font face="Calibri"><br>
</font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font size="2" face="sans-serif">The requested values to map are</font><span style="font-family: -webkit-standard; font-size: medium;"> </span><br style="font-family: -webkit-standard;">
<tt><font size="2">x-r25-first-name = urn:oid:2.5.4.42<br>
x-r25-family-name = urn:oid:2.5.4.4<br>
x-r25-email-work = urn:oid:0.9.2342.19200300.100.1.3<br>
x-r25-user = urn:oid:1.3.6.1.4.1.5923.1.1.1.6<br>
</font></tt><br style="font-family: -webkit-standard;">
<font size="2" face="sans-serif">It looks like there is a miscommunication in the release policy. Here's the info from our auth team</font><span style="font-family: -webkit-standard; font-size: medium;"> </span><br style="font-family: -webkit-standard;">
<br style="font-family: -webkit-standard;">
<tt><font size="2">they have only asserted one attribute (named "urn:oid:1.3.6.1.4.1.5923.1.1.1.9" (a.k.a. "eduPersonScopedAffiliation"). They are not releasing any of the attributes they have requested us to map. My first guess would be there is an error
in their attribute release policy. One common thing missed is to leave the trailing / off our entity ID.</font></tt></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font face="Calibri,sans-serif"><font face="Calibri"><br>
</font></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font face="Calibri,sans-serif"><font face="Calibri"><br>
</font></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><font face="Calibri,sans-serif"><font face="Calibri"><br>
</font></font></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;">Here is my attribute-resolver.xml</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
</div>
<div>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><b>attribute-resolver.xml</b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <!-- email is Email Address --></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="email" scope="mydomain.dom" sourceAttributeID="mail"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:Dependency ref="ActiveDirectory" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </resolver:AttributeDefinition></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <!-- surname is Last Name --></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="surname" scope="mydomain.dom" sourceAttributeID="sn"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:Dependency ref="ActiveDirectory" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </resolver:AttributeDefinition></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <!-- givenName is First Name --></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="givenName" scope="mydomain.dom" sourceAttributeID="givenName"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:Dependency ref="ActiveDirectory" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </resolver:AttributeDefinition></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonPrincipalName" scope="mydomain.dom" sourceAttributeID="sAMAccountName"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:Dependency ref="ActiveDirectory" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </resolver:AttributeDefinition></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><b><br>
</b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><resolver:DataConnector id="ActiveDirectory" xsi:type="dc:LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span>ldapURL="ldaps://server.mydomain.dom:636"</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span>connectionStrategy="DEFAULT"</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span>baseDN=“dc=mydomain,dc=dom" </p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span>principal=“CN=shibserv,OU=Services,DC=mydomain,DC=dom"</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span>principalCredential=“password"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><dc:FilterTemplate></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><![CDATA[</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span>(sAMAccountName=$requestContext.principalName)</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span>]]></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span></dc:FilterTemplate></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><ReturnAttributes>sAMAccountName mail givenName sn displayName</ReturnAttributes></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><LDAPProperty name="java.naming.referral" value="follow" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span></resolver:DataConnector></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;">Here is my attribute-filter.xml</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><b>attribute-filter.xml</b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <afp:AttributeRule attributeID="mail"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <afp:PermitValueRule xsi:type="basic:ANY" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </afp:AttributeRule></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="givenName"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <afp:PermitValueRule xsi:type="basic:ANY" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </afp:AttributeRule></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="sn"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <afp:PermitValueRule xsi:type="basic:ANY" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </afp:AttributeRule></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="sAMAccountName"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <afp:PermitValueRule xsi:type="basic:ANY" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </afp:AttributeRule></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"><span class="Apple-tab-span" style="white-space: pre;"></span><afp:AttributeRule attributeID="eduPersonScopedAffiliation"></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> <afp:PermitValueRule xsi:type="basic:ANY" /></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt;"> </afp:AttributeRule></p>
</div>
</div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE"></div>
</div>
</div>
</div>
</body>
</html>