<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I can’t seem to figure this out after much research and trial and error. This is using Shibboleth IdP 3.3.2. I can successfully authenticate via LDAP (on Active Directory) with my email address and it seems that the LDAP attributes are
being returned successfully according to ldaptive DEBUG logs, but the attributes are not being passed back to the SP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">FWIW, I would prefer to use sAMAccountName as the canonical username for our users, but allow them to authenticate using any email alias on their account. In other applications, finding the correct account by email address is done using
a query like this in AD: (proxyAddresses=smtp:EMAIL_ADDRESS)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Logs from idp-process.log: <a href="https://pastebin.com/CLwMh4Yx">
https://pastebin.com/CLwMh4Yx</a><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">******** conf/authn/ldap-authn-config.xml remains unchanged from the distribution copy ********<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">******** attribute-filter.xml ********<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif;color:black;background:white"><?xml version="1.0" encoding="UTF-8"?>
</span><span style="font-family:"Courier New",serif"><br>
<AttributeFilterPolicyGroup id="ShibbolethFilterPolicy" <br>
xmlns="urn:mace:shibboleth:2.0:afp" <br>
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <br>
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
<br>
<br>
<AttributeFilterPolicy id="sp-waffles"> <br>
<PolicyRequirementRule xsi:type="Requester" value="https://idp.testshib.org/idp/shibboleth" />
<br>
<br>
<AttributeRule attributeID="uid"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
<br>
<AttributeRule attributeID="mail"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
<br>
<AttributeRule attributeID="sn"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
<br>
<AttributeRule attributeID="givenName"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
</AttributeFilterPolicy> <br>
</AttributeFilterPolicyGroup><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal">******** ldap.properties ********<o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><br>
idp.authn.LDAP.authenticator = bindSearchAuthenticator <br>
idp.authn.LDAP.ldapURL = ldap://#########:389 <br>
idp.authn.LDAP.useStartTLS = false <br>
idp.authn.LDAP.useSSL = false <br>
idp.authn.LDAP.baseDN = OU=Our Users,DC=ourdomain,DC=com
<br>
idp.authn.LDAP.subtreeSearch = true <br>
idp.authn.LDAP.userFilter = (proxyAddresses=smtp:{user}) <br>
idp.authn.LDAP.bindDN = ######@ourdomain.com <br>
idp.authn.LDAP.bindDNCredential = ########## <br>
idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL} <br>
idp.attribute.resolver.LDAP.connectTimeout = %{idp.authn.LDAP.connectTimeout:PT3S}
<br>
idp.attribute.resolver.LDAP.responseTimeout = %{idp.authn.LDAP.responseTimeout:PT3S}
<br>
idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN:undefined}
<br>
idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN:undefined}
<br>
idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential:undefined}
<br>
idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}
<br>
idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates:undefined}
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"># I have tried both of the following and suspect this may be where the problem is? AD doesn’t typically use uid<br>
#idp.attribute.resolver.LDAP.searchFilter = (uid=$resolutionContext.principal)
<br>
idp.attribute.resolver.LDAP.searchFilter = (proxyAddresses=smtp:$resolutionContext.principal)
<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal">******** attribute-resolver.xml ********<o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier New",serif;color:black;background:white"><?xml version="1.0" encoding="UTF-8"?>
</span><span style="font-family:"Courier New",serif"><br>
<AttributeResolver <br>
xmlns="urn:mace:shibboleth:2.0:resolver" <br>
xmlns:sec="urn:mace:shibboleth:2.0:security" <br>
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <br>
xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
<br>
urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd">
<br>
<br>
<!-- ========================================== --> <br>
<!-- Attribute Definitions --> <br>
<!-- ========================================== --> <br>
<br>
<!-- Schema: Core schema attributes--> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="uid" sourceAttributeID="uid"> <br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="mail" sourceAttributeID="mail"> <br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="homePhone" sourceAttributeID="homePhone">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:homePhone" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.20" friendlyName="homePhone" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="homePostalAddress" sourceAttributeID="homePostalAddress">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:homePostalAddress" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.39" friendlyName="homePostalAddress" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="mobileNumber" sourceAttributeID="mobile">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mobile" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.41" friendlyName="mobile" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="pagerNumber" sourceAttributeID="pager">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:pager" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.42" friendlyName="pager" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="surname" sourceAttributeID="sn"> <br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:sn" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="locality" sourceAttributeID="l"> <br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:l" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.7" friendlyName="l" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="stateProvince" sourceAttributeID="st">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:st" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.8" friendlyName="st" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="street" sourceAttributeID="street">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:street" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.9" friendlyName="street" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="organizationName" sourceAttributeID="o">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:o" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.10" friendlyName="o" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="organizationalUnit" sourceAttributeID="ou">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:ou" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.11" friendlyName="ou" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="title" sourceAttributeID="title"> <br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:title" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.12" friendlyName="title" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="postalAddress" sourceAttributeID="postalAddress">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:postalAddress" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.16" friendlyName="postalAddress" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="postalCode" sourceAttributeID="postalCode">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:postalCode" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.17" friendlyName="postalCode" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="postOfficeBox" sourceAttributeID="postOfficeBox">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:postOfficeBox" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.18" friendlyName="postOfficeBox" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="telephoneNumber" sourceAttributeID="telephoneNumber">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:telephoneNumber" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.20" friendlyName="telephoneNumber" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="givenName" sourceAttributeID="givenName">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:givenName" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="initials" sourceAttributeID="initials">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:initials" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.43" friendlyName="initials" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<AttributeDefinition xsi:type="Simple" id="displayName" sourceAttributeID="displayName">
<br>
<Dependency ref="LDAP" /> <br>
<AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:displayName" encodeType="false" />
<br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.16.840.1.113730.3.1.241" friendlyName="displayName" encodeType="false" />
<br>
</AttributeDefinition> <br>
<br>
<!-- ========================================== --> <br>
<!-- Data Connectors --> <br>
<!-- ========================================== --> <br>
<br>
<DataConnector id="LDAP" xsi:type="LDAPDirectory" <br>
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}" <br>
baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br>
principal="%{idp.attribute.resolver.LDAP.bindDN}" <br>
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}" <br>
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}" <br>
connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}" <br>
responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"> <br>
<FilterTemplate> <br>
<![CDATA[ <br>
%{idp.attribute.resolver.LDAP.searchFilter} <br>
]]> <br>
</FilterTemplate> <br>
<ReturnAttributes>%{idp.authn.LDAP.returnAttributes}</ReturnAttributes> <br>
</DataConnector> <br>
<br>
</AttributeResolver></span><o:p></o:p></p>
</div>
</body>
</html>