<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div>Thank you. That's what I thought, but I'm a Unix guy and don't have much experience with AD. You've confirmed it for me.</div><div><br></div><div>Cheers</div><div>-Bob<br></div><div id="yui_3_16_0_ym19_1_1520368478071_10098"><span></span></div><div> </div><div class="signature" id="yui_3_16_0_ym19_1_1520368478071_10100"><div id="yui_3_16_0_ym19_1_1520368478071_10099">--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Tuesday, March 6, 2018 3:43 PM, "Kozlek, Vincent" <vkozlek@bloomu.edu> wrote:<br></font></div> <br><br> <div class="y_msg_container"><div id="yiv6413110491"><style>#yiv6413110491 #yiv6413110491 --
_filtered #yiv6413110491 {font-family:Helvetica;panose-1:2 11 6 4 2 2 2 2 2 4;}
_filtered #yiv6413110491 {panose-1:2 4 5 3 5 4 6 3 2 4;}
_filtered #yiv6413110491 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}
#yiv6413110491
#yiv6413110491 p.yiv6413110491MsoNormal, #yiv6413110491 li.yiv6413110491MsoNormal, #yiv6413110491 div.yiv6413110491MsoNormal
{margin:0in;margin-bottom:.0001pt;font-size:12.0pt;}
#yiv6413110491 a:link, #yiv6413110491 span.yiv6413110491MsoHyperlink
{color:blue;text-decoration:underline;}
#yiv6413110491 a:visited, #yiv6413110491 span.yiv6413110491MsoHyperlinkFollowed
{color:purple;text-decoration:underline;}
#yiv6413110491 p.yiv6413110491msonormal0, #yiv6413110491 li.yiv6413110491msonormal0, #yiv6413110491 div.yiv6413110491msonormal0
{margin-right:0in;margin-left:0in;font-size:12.0pt;}
#yiv6413110491 span.yiv6413110491EmailStyle18
{color:#1F497D;}
#yiv6413110491 .yiv6413110491MsoChpDefault
{font-size:10.0pt;}
_filtered #yiv6413110491 {margin:1.0in 1.0in 1.0in 1.0in;}
#yiv6413110491 div.yiv6413110491WordSection1
{}
#yiv6413110491 </style><div>
<div class="yiv6413110491WordSection1">
<div class="yiv6413110491MsoNormal"><span style="font-size:11.0pt;">In my experience, if an attribute value is blank or null, it will not show as being sent, so I think you answered your own question since I think you said the
source value is not populated in AD.</span></div>
<div class="yiv6413110491MsoNormal"><span style="font-size:11.0pt;"> </span></div>
<div class="yiv6413110491yqt4140819229" id="yiv6413110491yqt55888"><div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in;">
<div class="yiv6413110491MsoNormal"><b><span style="font-size:11.0pt;">From:</span></b><span style="font-size:11.0pt;"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Robert Lamothe<br clear="none">
<b>Sent:</b> Tuesday, March 6, 2018 3:23 PM<br clear="none">
<b>To:</b> Shib Users <users@shibboleth.net><br clear="none">
<b>Subject:</b> Re: Missing Attributes</span></div>
</div>
</div>
<div class="yiv6413110491MsoNormal"> </div>
<div>
<div>
<div class="yiv6413110491MsoNormal" style="background:white;"><span style="font-size:10.0pt;">Ok, thanks, but do you have any idea why some users get eduPersonPrimaryAffiliation and some don't?</span></div>
</div>
<div>
<div class="yiv6413110491MsoNormal" style="background:white;"><span style="font-size:10.0pt;"> </span></div>
</div>
<div>
<div class="yiv6413110491MsoNormal" style="background:white;"><span style="font-size:10.0pt;">Thanks</span></div>
</div>
<div id="yiv6413110491yui_3_16_0_ym19_1_1520346615306_147950">
<div class="yiv6413110491MsoNormal" style="background:white;"><span style="font-size:10.0pt;">-Bob</span></div>
</div>
<div>
<div class="yiv6413110491MsoNormal" style="background:white;"><span style="font-size:10.0pt;"> </span></div>
</div>
<div id="yiv6413110491yui_3_16_0_ym19_1_1520346615306_147952">
<div id="yiv6413110491yui_3_16_0_ym19_1_1520346615306_147951">
<div class="yiv6413110491MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style="font-size:10.0pt;">--<br clear="none">
Bob Lamothe<br clear="none">
<a rel="nofollow" shape="rect" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br clear="none">
KB1BOB<br clear="none">
603-918-6336</span></div>
</div>
</div>
<div>
<div class="yiv6413110491MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style="font-size:10.0pt;"> </span></div>
</div>
<div>
<div>
<div>
<div>
<div class="yiv6413110491MsoNormal" style="background:white;"><span style="font-size:10.0pt;">On Tuesday, March 6, 2018 3:19 PM, "Boyd, Todd M." <<a rel="nofollow" shape="rect" ymailto="mailto:tmboyd1@ccis.edu" target="_blank" href="mailto:tmboyd1@ccis.edu">tmboyd1@ccis.edu</a>> wrote:</span><span style=""></span></div>
</div>
<div class="yiv6413110491MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style=""> </span></div>
<div>
<div>
<div class="yiv6413110491MsoNormal" style="background:white;"><span style="">You can set the NameID generation on a per-SP basis without needing separate installations of Shibboleth IdP. We have to do this for a few of our service
providers that require things like email instead of a transient value.<br clear="none">
<br clear="none">
________________________________</span></div>
<div id="yiv6413110491yqtfd99572">
<div class="yiv6413110491MsoNormal" style="background:white;"><span style=""><br clear="none">
From: users <<a rel="nofollow" shape="rect" ymailto="mailto:users-bounces@shibboleth.net" target="_blank" href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Robert Lamothe <<a rel="nofollow" shape="rect" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>><br clear="none">
Sent: Tuesday, March 6, 2018 2:13:19 PM<br clear="none">
To: Shib Users<br clear="none">
Subject: Missing Attributes<br clear="none">
<br clear="none">
Hello Shib Users,<br clear="none">
<br clear="none">
I have a curious situation.<br clear="none">
<br clear="none">
I have an SP that our users use and I've noticed that not all users get the same attributes sent. For example, when I login I get the following attributes:<br clear="none">
<br clear="none">
"name": "eduPersonPrimaryAffiliation",<br clear="none">
<br clear="none">
"name": "mail",<br clear="none">
<br clear="none">
"name": "displayName",<br clear="none">
<br clear="none">
"name": "surname",<br clear="none">
<br clear="none">
"name": "givenName",<br clear="none">
<br clear="none">
"name": "eduPersonPrincipalName",<br clear="none">
<br clear="none">
Another user gets the following:<br clear="none">
<br clear="none">
"name": "mail",<br clear="none">
<br clear="none">
"name": "displayName",<br clear="none">
<br clear="none">
"name": "surname",<br clear="none">
<br clear="none">
"name": "givenName",<br clear="none">
<br clear="none">
"name": "eduPersonPrincipalName",<br clear="none">
<br clear="none">
As you can see "eduPersonPrimaryAffiliation" is missing on this second user.<br clear="none">
<br clear="none">
So, my questions are:<br clear="none">
<br clear="none">
1) Is this more likely an AD issue or a Shibboleth issue?<br clear="none">
2) If an attributed isn't populated in AD will it not be visible in Shibboleth<br clear="none">
<br clear="none">
I have two shibboleth clusters because 1 of our SPs needs the NameID property to deliver email, and the second cluster has NameID set to transient which is required by other SPs. I see the same behavior on both clusters so either I made the same mistake
on both clusters or AD is somehow behind it.<br clear="none">
<br clear="none">
Thanks in Advance<br clear="none">
-Bob<br clear="none">
<br clear="none">
--<br clear="none">
Bob Lamothe<br clear="none">
<a rel="nofollow" shape="rect" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br clear="none">
KB1BOB<br clear="none">
603-918-6336</span></div>
</div>
<div class="yiv6413110491MsoNormal" style="background:white;"><span style=""><br clear="none">
<br clear="none">
-- <br clear="none">
For Consortium Member technical support, see <a rel="nofollow" shape="rect" target="_blank" href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=HS1CjnFyfzCL6mp0nkGYYw&r=fcOQXz172F3_F6VsMvwQJrlyp8lrJiXC6od3a6A_UtM&m=ISNNCHkse7SSXb1tnIh3GO54ZqwArtcC_ssHWJkF3Rc&s=45B19HCTjHB4WJ1v9tO-gvgyzLtCMi-yyyjGdLEiav4&e=">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">
To unsubscribe from this list send an email to <a rel="nofollow" shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span></div>
<div id="yiv6413110491yqtfd43081">
<div class="yiv6413110491MsoNormal" style="background:white;"><span style=""> </span></div>
</div>
</div>
<div class="yiv6413110491MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style=""> </span></div>
</div>
</div>
</div>
</div>
</div></div>
</div>
</div></div><div class="yqt4140819229" id="yqt23357">-- <br clear="none">For Consortium Member technical support, see <a shape="rect" href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div><br><br></div> </div> </div> </div></div></body></html>