<div dir="ltr">An attribute with null value - as explicitly indicated in your log snippet - will not be sent.<div><br><div>You don't include the attribute resolver definition but the earlier log entry indicates an LDAP value of "Staff" which is not scoped.</div><div><br></div><div>I'm not at all clear what you're trying to do in attempting to release a "transient" identifier that has the persistent (i.e., non-transient) value of a directory attribute - isn't that a category mis-match?</div></div><div><br></div><div>David Bantz</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 14, 2018 at 11:48 AM, Thermal Reboot <span dir="ltr"><<a href="mailto:thermalreboot@gmail.com" target="_blank">thermalreboot@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div>Hello,<br><br></div>    I have an SP that requires eduPersonScopedAffiliation and eduPersonTargetedID.  To test this I setup my attribute-filter.xml files to deliver these two attributes to <a href="http://sp.testshib.org" target="_blank">sp.testshib.org</a>, but neither of them are being delivered.  <br><br></div>    I've verified that both attributes are populated in AD and can see that they're being delivered by LDAP:<br><br>2018-06-14 15:00:50,193 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.<wbr>AbstractDataConnector:143] - Data Connector 'myLDAP': Attribute 'eduPersonScopedAffiliation': Values '[StringAttributeValue{value=<wbr>Staff}]'<br><br>2018-06-14 15:00:50,194 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.<wbr>AbstractDataConnector:143] - Data Connector 'myLDAP': Attribute 'eduPersonTargetedID': Values '[StringAttributeValue{value=<wbr>lamother}]'<br><br></div>Yet I also see this:<br><br>2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:372] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'eduPersonScopedAffiliation'<br>2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:388] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'eduPersonScopedAffiliation'<br>2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.<wbr>AbstractAttributeDefinition:<wbr>245] - Attribute Definition 'eduPersonScopedAffiliation': produced an attribute with no values<br>2018-06-14 10:21:50,313 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'eduPersonScopedAffiliation' produced an attribute with 0 values<br>2018-06-14 10:21:50,353 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:428] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute definition 'eduPersonScopedAffiliation', contains no values<br><br><br></div>And<br><br>2018-06-14 15:00:50,261 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:372] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'eduPersonTargetedID'<br>2018-06-14 15:00:50,264 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:388] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'eduPersonTargetedID'<br>2018-06-14 15:00:50,276 - DEBUG [net.shibboleth.idp.saml.<wbr>attribute.resolver.impl.<wbr>SAML2NameIDAttributeDefinition<wbr>:153] - Attribute Definition 'eduPersonTargetedID': building a SAML2 NameID with value of 'XgQzYSIOcCKtS8gcaeSXYCyfsfE='<br>2018-06-14 15:00:50,276 - DEBUG [net.shibboleth.idp.saml.<wbr>attribute.resolver.impl.<wbr>SAML2NameIDAttributeDefinition<wbr>:164] - Attribute Definition 'eduPersonTargetedID': Format set to 'urn:oasis:names:tc:SAML:2.0:<wbr>nameid-format:persistent'<br>2018-06-14 15:00:50,277 - DEBUG [net.shibboleth.idp.saml.<wbr>attribute.resolver.impl.<wbr>SAML2NameIDAttributeDefinition<wbr>:172] - Attribute Definition 'eduPersonTargetedID': NameQualifier set to '<a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">https://testshib.umassmed.<wbr>edu/idp/shibboleth</a>'<br>2018-06-14 15:00:50,277 - DEBUG [net.shibboleth.idp.saml.<wbr>attribute.resolver.impl.<wbr>SAML2NameIDAttributeDefinition<wbr>:182] - Attribute Definition 'eduPersonTargetedID': SPNameQualifier set to '<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/<wbr>shibboleth-sp</a>'<br>2018-06-14 15:00:50,278 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.<wbr>AbstractAttributeDefinition:<wbr>247] - Attribute Definition 'eduPersonTargetedID': produced an attribute with the following values [XMLObjectAttributeValue{<wbr>value=org.opensaml.saml.saml2.<wbr>core.impl.NameIDImpl@d7124d8}]<br>2018-06-14 15:00:50,278 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'eduPersonTargetedID' produced an attribute with 1 values<br>2018-06-14 15:00:50,366 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:434] - Attribute Resolver 'ShibbolethAttributeResolver': De-duping attribute definition eduPersonTargetedID result<br>2018-06-14 15:00:50,366 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:446] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute 'eduPersonTargetedID' has 1 values after post-processing<br><br><br></div>My decrypted Assertion at <a href="http://sp.testshib.org" target="_blank">sp.testshib.org</a> looks like:<br><br><pre>2018-06-14 15:41:49 DEBUG Shibboleth.SSO.SAML2 [76]: decrypted Assertion: <saml2:Assertion xmlns:saml2="urn:oasis:names:<wbr>tc:SAML:2.0:assertion" ID="_<wbr>f8ee0b26b509a4840675be141cefd1<wbr>f0" IssueInstant="2018-06-14T19:<wbr>41:48.238Z" Version="2.0"><saml2:Issuer><a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">ht<wbr>tps://testshib.umassmed.edu/<wbr>idp/shibboleth</a></saml2:Issuer><<wbr>saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:<wbr>SAML:2.0:nameid-format:<wbr>transient" NameQualifier="<a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">https://<wbr>testshib.umassmed.edu/idp/<wbr>shibboleth</a>" SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.<wbr>testshib.org/shibboleth-sp</a>" xmlns:saml2="urn:oasis:names:<wbr>tc:SAML:2.0:assertion"><wbr>AAlzZWNyZXQ4ODZCiDJKa7lVg5ZzS4<wbr>KC9fJRKm/5M3zTvK1kZ6/<wbr>O2iqrEfMDjzNgTuD0OlQEQgXQdq/<wbr>CSEVuJmHIAy7+<wbr>eFJ4bgYz80Znlp0oMPad2nyuLIxI3x<wbr>qZOIP31dMgqHCaWmYzNvCpG4LL0W5I<wbr>nfUv</saml2:NameID><saml2:<wbr>SubjectConfirmation Method="urn:oasis:names:tc:<wbr>SAML:2.0:cm:bearer"><saml2:<wbr>SubjectConfirmationData Address="146.189.148.19" InResponseTo="_<wbr>d3f4f0823fe28c735d62a9ed6d7175<wbr>52" NotOnOrAfter="2018-06-14T19:<wbr>46:48.364Z" Recipient="<a href="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" target="_blank">https://sp.<wbr>testshib.org/Shibboleth.sso/<wbr>SAML2/POST</a>"/></saml2:<wbr>SubjectConfirmation></saml2:<wbr>Subject><saml2:Conditions NotBefore="2018-06-14T19:41:<wbr>48.238Z" NotOnOrAfter="2018-06-14T19:<wbr>46:48.238Z"><saml2:<wbr>AudienceRestriction><saml2:<wbr>Audience><a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.<wbr>org/shibboleth-sp</a></saml2:<wbr>Audience></saml2:<wbr>AudienceRestriction></saml2:<wbr>Conditions><saml2:<wbr>AuthnStatement AuthnInstant="2018-06-14T19:<wbr>41:39.175Z" SessionIndex="_<wbr>881534154dad964ab5923b2ec0e9e3<wbr>55"><saml2:SubjectLocality Address="146.189.148.19"/><<wbr>saml2:AuthnContext><saml2:<wbr>AuthnContextClassRef>urn:<wbr>oasis:names:tc:SAML:2.0:ac:<wbr>classes:<wbr>PasswordProtectedTransport</<wbr>saml2:AuthnContextClassRef></<wbr>saml2:AuthnContext></saml2:<wbr>AuthnStatement><saml2:<wbr>AttributeStatement><saml2:<wbr>Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.<wbr>19200300.100.1.1" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><wbr>LamotheR</saml2:<wbr>AttributeValue></saml2:<wbr>Attribute><saml2:Attribute FriendlyName="<wbr>eduPersonPrimaryAffiliation" Name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.5" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><wbr>Staff</saml2:AttributeValue></<wbr>saml2:Attribute><saml2:<wbr>Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.<wbr>19200300.100.1.3" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><a href="mailto:Robert.Lamothe@umassmed.edu" target="_blank">Rob<wbr>ert.Lamothe@umassmed.edu</a></<wbr>saml2:AttributeValue></saml2:<wbr>Attribute><saml2:Attribute FriendlyName="<wbr>eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.10" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><<wbr>saml2:NameID Format="urn:oasis:names:tc:<wbr>SAML:2.0:nameid-format:<wbr>persistent" NameQualifier="<a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">https://<wbr>testshib.umassmed.edu/idp/<wbr>shibboleth</a>" SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.<wbr>testshib.org/shibboleth-sp</a>"><wbr>XgQzYSIOcCKtS8gcaeSXYCyfsfE=</<wbr>saml2:NameID></saml2:<wbr>AttributeValue></saml2:<wbr>Attribute><saml2:Attribute FriendlyName="displayName" Name="urn:oid:2.16.840.1.<wbr>113730.3.1.241" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><wbr>Lamothe, Robert L</saml2:AttributeValue></<wbr>saml2:Attribute><saml2:<wbr>Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><wbr>Lamothe</saml2:AttributeValue><wbr></saml2:Attribute><saml2:<wbr>Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><wbr>Robert</saml2:AttributeValue><<wbr>/saml2:Attribute><saml2:<wbr>Attribute FriendlyName="<wbr>eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.6" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue><a href="mailto:lamother@umassmed.edu" target="_blank">lam<wbr>other@umassmed.edu</a></saml2:<wbr>AttributeValue></saml2:<wbr>Attribute><saml2:Attribute FriendlyName="title" Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>uri"><saml2:AttributeValue>Sr Eng, Sys Admin</saml2:AttributeValue></<wbr>saml2:Attribute></saml2:<wbr>AttributeStatement><br></saml2:AttributeStatement></<wbr>saml2:Assertion><br><br></pre><pre>In the Assertion I see eduPersonTargetedID which looks like it's being set to NameID instead of the AD value,<br></pre><pre>yet I don't see eduPersonScopedAffiliation.<br><br></pre><pre>Am I miss understanding something?  Is my config messed up?<br><br></pre><pre>Thanks<br></pre><pre>-Bob<br></pre></div>
<br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>