<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 4/26/17 1:37 PM, Edward Patri wrote:<br>
</div>
<blockquote type="cite"
cite="mid:9244936e89104b6099953fe92477e953@MBOX-01.FLAS.CSI.CUNY.EDU">
<pre wrap="">
They are stating that there is no attribute statement in our meta data. </pre>
</blockquote>
<br>
I think you mean no AttributeStatement in the Assertion, not
metadata. The latter has a specific and different meaning in SAML.<br>
<br>
<blockquote type="cite"
cite="mid:9244936e89104b6099953fe92477e953@MBOX-01.FLAS.CSI.CUNY.EDU">
<pre wrap="">
Below is the log that they provided us
</pre>
</blockquote>
<br>
Correct, there's no AttributeStatement there.<br>
<br>
<blockquote type="cite"
cite="mid:9244936e89104b6099953fe92477e953@MBOX-01.FLAS.CSI.CUNY.EDU">
<pre wrap="">
However, when I check our configuration using AACLI it shows that the attribute is being sucessfully released to their SP.</pre>
</blockquote>
<br>
Well, actually it doesn't. There is no AttributeStatement there
either. See below.<br>
<br>
<blockquote type="cite"
cite="mid:9244936e89104b6099953fe92477e953@MBOX-01.FLAS.CSI.CUNY.EDU">
<pre wrap="">
Below is the output from the aacli
C:\Program Files (x86)\Shibboleth\IdP\bin>aacli.bat --configDir=conf/ --principal=hobson.student@cix.csi.cuny.edu --requester=<a class="moz-txt-link-freetext" href="https://services02.askadmissions.net/shibboleth/sp">https://services02.askadmissions.net/shibboleth/sp</a> --saml2 <?xml version="1.0" encoding="UTF-8"?> <saml2:Assertion ID="_623e73d6a0cfee0c4694517fe9868113"
IssueInstant="2017-04-24T16:34:57.188Z" Version="2.0" xmlns:saml2="urn:oasis :names:tc:SAML:2.0:assertion">
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier=<a class="moz-txt-link-rfc2396E" href="https://idp.csi.cuny.edu/idp/shibboleth">"https://idp.csi.cuny.edu/idp/shibboleth"</a> SPNameQualif ier=<a class="moz-txt-link-rfc2396E" href="https://services02.askadmissions.net/shibboleth/sp">"https://services02.askadmissions.net/shibboleth/sp"</a>>AAdzZWNyZXQxLs6sWmSDgDp
1GtYsDTK9YKOW6A0mR5LOBCb1Eg/Rvw2EbYD9dPWcF/m6Ep+ZkrsC1dC/SPqcNrHJbVsx+pqUbnMBm9X
+tjgVZOUW549lsFVFAVgBphYX+oQoKrOTjyatvG/Yfo1D8NPJQYtW5GNBmlCcn3LaaqKPvIF
+tjgVZOUW549lsFVFAVgBphYX++tBFD6nT
355Hu0vcP0HvZ25Ne</saml2:NameID>
</saml2:Subject>
</saml2:Assertion>
</pre>
</blockquote>
<br>
<br>
Following the saml2:Subject element, you should expect to see a
saml2:AttributeStatement element, containing at least one
saml2:Attribute with the eduPersonPrincipalName data. There isn't,
which implies there's something wrong with your IdP configuration,
either your attribute resolver or maybe something else. For
example, do your LDAP attribute sources actually have an attribute
'userPrincipalName', that is resolvable using the LDAP credentials
and search info you have configured?<br>
<br>
If you can't solve by looking at the config along, then looking at
your IdP logs on DEBUG should help diagnose it.<br>
<br>
<br>
</body>
</html>