<div dir="ltr"><div class="gmail_default"><font face="times new roman, serif">In troubleshooting something like this, I find it useful to turn up the debug logging. In conf/logback.xml, modify idp.loglevel.idp and idp.loglevel.ldap to DEBUG and restart. The tail logs/idp-process.log while you test the login. In the logs you will then see the LDAP connection happening, you will see the LDAP attributes that come back, you will see the attribute resolution happening, and then finally you will see the attribute filtering process. Somewhere in there you will hopefully see the problem.</font><br></div><div class="gmail_default"><font face="times new roman, serif"><br></font></div><div class="gmail_default"><font face="times new roman, serif">And as Michael mentioned, that entity ID may not be correct (in which case you will see in the logs that the filtering is where the breakdown is happening). If you are not sure of the entity ID, you may want to take a look at using RequesterRegex in the filter (<a href="https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration</a>).</font></div><div class="gmail_default"><font face="times new roman, serif"><br></font></div><div class="gmail_default"><font face="times new roman, serif">Cheers!</font></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><br><font face="times new roman, serif">Brian Moon</font><br><font face="times new roman, serif">Senior System Administrator</font><br><font face="times new roman, serif">Enterprise Systems</font><br><font face="times new roman, serif">Santa Clara University</font><br><font face="times new roman, serif">Office: 408.554.4830</font><br><a href="mailto:bmoon@scu.edu" style="font-family:'times new roman',serif" target="_blank">bmoon@scu.edu</a><br></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Apr 5, 2017 at 2:32 PM, Michael A Grady <span dir="ltr"><<a href="mailto:mgrady@unicon.net" target="_blank">mgrady@unicon.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><span class=""><blockquote type="cite"><div>On Apr 5, 2017, at 4:20 PM, Bob Dill <<a href="mailto:rdill@cameron.edu" target="_blank">rdill@cameron.edu</a>> wrote:</div><br class="m_1730564208407219057Apple-interchange-newline"><div><div class="m_1730564208407219057WordSection1" style="font-family:Helvetica;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Hi All,<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">I am working to authenticate students for scholarship information provided by Academic Works (AW). I have successfully installed and tested Shibboleth with testshib, but I still can’t authenticate with AW because Shibboleth is not releasing uid or mail attributes.<span class="m_1730564208407219057Apple-converted-space"> </span><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Inside my ldap properties, I have<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">idp.authn.LDAP.<wbr>returnAttributes <wbr> = passwordExpirationTime,<wbr>loginGraceRemaining,uid,mail</div></div></div></blockquote><div><br></div></span>Technically, that property in ldap.properties was meant for attributes to be returned at the Authentication stage, not at the Resolver stage. There was another property in the resolver section of the property file, but everyone decide that trying to manage the set of attributes to be returned to the resolver as a property in that file is a mistake. Which is why a resolver specific property is no longer in that file. Just put the list of attributes to be returned to the resolver *in* the attribute-resolver Data Connector directly.</div><div><div><div class="h5"><br><blockquote type="cite"><div><div class="m_1730564208407219057WordSection1" style="font-family:Helvetica;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Inside my attribute-resolver.conf, I have<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><AttributeDefinition id="uid" xsi:type="Simple" sourceAttributeID="uid"><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <Dependency ref="myLDAP" /><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-<wbr>def:uid" encodeType="false" /><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.<wbr>19200300.100.1.1" friendlyName="uid" encodeType="false" /><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> </AttributeDefinition><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <!--<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> In the rest of the world, the email address is the standard identifier,<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> despite the problems with that practice. Consider making the EPPN value<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> the same as your official email addresses whenever possible.<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> --><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <AttributeDefinition id="mail" xsi:type="Simple" sourceAttributeID="mail"><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <Dependency ref="myLDAP" /><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-<wbr>def:mail" encodeType="false" /><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.<wbr>19200300.100.1.3" friendlyName="mail" encodeType="false" /><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> </AttributeDefinition><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><DataConnector id="myLDAP" xsi:type="LDAPDirectory"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> ldapURL="%{idp.attribute.<wbr>resolver.LDAP.ldapURL}"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> baseDN="%{idp.attribute.<wbr>resolver.LDAP.baseDN1}"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> principal="%{idp.attribute.<wbr>resolver.LDAP.bindDN}"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> principalCredential="%{idp.<wbr>attribute.resolver.LDAP.<wbr>bindDNCredential}"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> useStartTLS="%{idp.attribute.<wbr>resolver.LDAP.useStartTLS:<wbr>false}"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> connectTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>connectTimeout}"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> trustFile="%{idp.attribute.<wbr>resolver.LDAP.<wbr>trustCertificates}"<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> responseTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>responseTimeout}"><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <FilterTemplate><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <![CDATA[<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> %{idp.attribute.resolver.LDAP.<wbr>searchFilter}<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> ]]><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> </FilterTemplate><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <ReturnAttributes>%{idp.authn.<wbr>LDAP.returnAttributes}</<wbr>ReturnAttributes><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <FailoverDataConnector ref="myLDAP2" /><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> </DataConnector><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Finally, in my attribute-filter.xml file, I have<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <!-- Release some attributes to an SP. --><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <AttributeFilterPolicy id="example1"><u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"> <PolicyRequirementRule xsi:type="Requester" value="<a href="https://cameron.academicworks.com/Shibboleth.sso" style="color:rgb(149,79,114);text-decoration:underline" target="_blank">https://cameron.<wbr>academicworks.com/Shibboleth.<wbr>sso</a>" /></div></div></div></blockquote><div><br></div></div></div>Are you sure that is actually the entityID value in the Academic Works metadata you have? I've seen Academic Works entityIDs in the past, and none ended in 'Shibboleth.sso'. The value you list for Requestor in that rule must be the *entityID* for the SP, check your Academic Works metadata to see what that value is.</div><div><br><blockquote type="cite"><div><div class="m_1730564208407219057WordSection1" style="font-family:Helvetica;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></div></div></div></blockquote></div><br><div>
<div style="color:rgb(0,0,0);font-family:Helvetica;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">--<br>Michael A. Grady<br>IAM Architect, Unicon, Inc.</div><div style="color:rgb(0,0,0);font-family:Helvetica;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><br></div><br class="m_1730564208407219057Apple-interchange-newline">
</div>
<br></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>