<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">In my experience, if an attribute value is blank or null, it will not show as being sent, so I think you answered your own question since I think you said the
source value is not populated in AD.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Robert Lamothe<br>
<b>Sent:</b> Tuesday, March 6, 2018 3:23 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Missing Attributes<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Ok, thanks, but do you have any idea why some users get eduPersonPrimaryAffiliation and some don't?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">Thanks<o:p></o:p></span></p>
</div>
<div id="yui_3_16_0_ym19_1_1520346615306_147950">
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">-Bob<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black"> <o:p></o:p></span></p>
</div>
<div id="yui_3_16_0_ym19_1_1520346615306_147952">
<div id="yui_3_16_0_ym19_1_1520346615306_147951">
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black">--<br>
Bob Lamothe<br>
<a href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br>
KB1BOB<br>
603-918-6336<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">On Tuesday, March 6, 2018 3:19 PM, "Boyd, Todd M." <<a href="mailto:tmboyd1@ccis.edu">tmboyd1@ccis.edu</a>> wrote:</span><span style="font-family:"Helvetica",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Helvetica",sans-serif;color:black">You can set the NameID generation on a per-SP basis without needing separate installations of Shibboleth IdP. We have to do this for a few of our service
providers that require things like email instead of a transient value.<br>
<br>
________________________________<o:p></o:p></span></p>
<div id="yqtfd99572">
<p class="MsoNormal" style="background:white"><span style="font-family:"Helvetica",sans-serif;color:black"><br>
From: users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Robert Lamothe <<a href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>><br>
Sent: Tuesday, March 6, 2018 2:13:19 PM<br>
To: Shib Users<br>
Subject: Missing Attributes<br>
<br>
Hello Shib Users,<br>
<br>
I have a curious situation.<br>
<br>
I have an SP that our users use and I've noticed that not all users get the same attributes sent. For example, when I login I get the following attributes:<br>
<br>
"name": "eduPersonPrimaryAffiliation",<br>
<br>
"name": "mail",<br>
<br>
"name": "displayName",<br>
<br>
"name": "surname",<br>
<br>
"name": "givenName",<br>
<br>
"name": "eduPersonPrincipalName",<br>
<br>
Another user gets the following:<br>
<br>
"name": "mail",<br>
<br>
"name": "displayName",<br>
<br>
"name": "surname",<br>
<br>
"name": "givenName",<br>
<br>
"name": "eduPersonPrincipalName",<br>
<br>
As you can see "eduPersonPrimaryAffiliation" is missing on this second user.<br>
<br>
So, my questions are:<br>
<br>
1) Is this more likely an AD issue or a Shibboleth issue?<br>
2) If an attributed isn't populated in AD will it not be visible in Shibboleth<br>
<br>
I have two shibboleth clusters because 1 of our SPs needs the NameID property to deliver email, and the second cluster has NameID set to transient which is required by other SPs. I see the same behavior on both clusters so either I made the same mistake
on both clusters or AD is somehow behind it.<br>
<br>
Thanks in Advance<br>
-Bob<br>
<br>
--<br>
Bob Lamothe<br>
<a href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br>
KB1BOB<br>
603-918-6336<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Helvetica",sans-serif;color:black"><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=HS1CjnFyfzCL6mp0nkGYYw&r=fcOQXz172F3_F6VsMvwQJrlyp8lrJiXC6od3a6A_UtM&m=ISNNCHkse7SSXb1tnIh3GO54ZqwArtcC_ssHWJkF3Rc&s=45B19HCTjHB4WJ1v9tO-gvgyzLtCMi-yyyjGdLEiav4&e=" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></span></p>
<div id="yqtfd43081">
<p class="MsoNormal" style="background:white"><span style="font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-family:"Helvetica",sans-serif;color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>