<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div>Ok, thanks, but do you have any idea why some users get eduPersonPrimaryAffiliation and some don't?</div><div><br></div><div>Thanks</div><div id="yui_3_16_0_ym19_1_1520346615306_147950">-Bob<br></div><div><span></span></div><div> </div><div class="signature" id="yui_3_16_0_ym19_1_1520346615306_147952"><div id="yui_3_16_0_ym19_1_1520346615306_147951">--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Tuesday, March 6, 2018 3:19 PM, "Boyd, Todd M." <tmboyd1@ccis.edu> wrote:<br></font></div> <br><br> <div class="y_msg_container"><div dir="ltr">You can set the NameID generation on a per-SP basis without needing separate installations of Shibboleth IdP. We have to do this for a few of our service providers that require things like email instead of a transient value.<br clear="none"><br clear="none">________________________________<div class="yqt2359164849" id="yqtfd99572"><br clear="none">From: users <<a shape="rect" ymailto="mailto:users-bounces@shibboleth.net" href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Robert Lamothe <<a shape="rect" ymailto="mailto:robert_lamothe@yahoo.com" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>><br clear="none">Sent: Tuesday, March 6, 2018 2:13:19 PM<br clear="none">To: Shib Users<br clear="none">Subject: Missing Attributes<br clear="none"><br clear="none">Hello Shib Users,<br clear="none"><br clear="none"> I have a curious situation.<br clear="none"><br clear="none"> I have an SP that our users use and I've noticed that not all users get the same attributes sent. For example, when I login I get the following attributes:<br clear="none"><br clear="none"> "name": "eduPersonPrimaryAffiliation",<br clear="none"><br clear="none"> "name": "mail",<br clear="none"><br clear="none"> "name": "displayName",<br clear="none"><br clear="none"> "name": "surname",<br clear="none"><br clear="none"> "name": "givenName",<br clear="none"><br clear="none"> "name": "eduPersonPrincipalName",<br clear="none"><br clear="none"> Another user gets the following:<br clear="none"><br clear="none"> "name": "mail",<br clear="none"><br clear="none"> "name": "displayName",<br clear="none"><br clear="none"> "name": "surname",<br clear="none"><br clear="none"> "name": "givenName",<br clear="none"><br clear="none"> "name": "eduPersonPrincipalName",<br clear="none"><br clear="none"> As you can see "eduPersonPrimaryAffiliation" is missing on this second user.<br clear="none"><br clear="none"> So, my questions are:<br clear="none"><br clear="none"> 1) Is this more likely an AD issue or a Shibboleth issue?<br clear="none"> 2) If an attributed isn't populated in AD will it not be visible in Shibboleth<br clear="none"><br clear="none"> I have two shibboleth clusters because 1 of our SPs needs the NameID property to deliver email, and the second cluster has NameID set to transient which is required by other SPs. I see the same behavior on both clusters so either I made the same mistake on both clusters or AD is somehow behind it.<br clear="none"><br clear="none">Thanks in Advance<br clear="none">-Bob<br clear="none"><br clear="none">--<br clear="none">Bob Lamothe<br clear="none"><a shape="rect" ymailto="mailto:robert_lamothe@yahoo.com" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br clear="none">KB1BOB<br clear="none">603-918-6336</div><br clear="none"><br clear="none">-- <br clear="none">For Consortium Member technical support, see <a shape="rect" href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><div class="yqt2359164849" id="yqtfd43081"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>