<div dir="ltr"><div><div><div>Hi David,<br><br></div> I guess I'm confused on the idea of scope, I can't find a clear definition of it, all the docs I read assume you know what that is. Is scope something I'm matching on? Would I put <a href="http://testshib.org">testshib.org</a> there if I wanted that attribute to be delivered to <a href="http://testshib.org">testshib.org</a>? Or is it something else? In my definition I have scope="%{idp.scope}", is this a wild card? or a place holder that I need to replace?<br><br></div>Thanks<br></div>-Bob<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 20, 2018 at 2:16 PM, IAM David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Sorry I haven't been much help. <div><br></div><div>The scope in my resolver definitions is <a href="http://alaska.edu" target="_blank">alaska.edu</a> because that's the scope for my IdP. Yours will of course be whatever scope for which your IdP is authoritative.</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>David Bantz</div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 20, 2018 at 9:02 AM, Thermal Reboot <span dir="ltr"><<a href="mailto:thermalreboot@gmail.com" target="_blank">thermalreboot@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>Hi David,<br><br></div> I'm still trying to make this work but no luck so far, when I copied and pasted your definition it broke my IDP. Here are my definitions:<span><br><br> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonScopedAffiliation<wbr>" scope="%{idp.scope}" sourceAttributeID="eduPersonAf<wbr>filiation"><br> <resolver:Dependency ref="myLDAP" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedStrin<wbr>g" name="urn:mace:dir:attribute-d<wbr>ef:eduPersonScopedAffiliation" encodeType="false" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedStrin<wbr>g" name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.9" friendlyName="eduPersonScopedA<wbr>ffiliation" encodeType="false" /><br> </resolver:AttributeDefinition<wbr>><br><br></span>You mentioned my eduPersonAffiliation definition so here it is:<br><br> <resolver:AttributeDefinition xsi:type="ad:Simple" id="eduPersonAffiliation" sourceAttributeID="eduPersonAf<wbr>filiation"><span><br> <resolver:Dependency ref="myLDAP" /><br></span> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-d<wbr>ef:eduPersonAffiliation" encodeType="false" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.1" friendlyName="eduPersonAffilia<wbr>tion" encodeType="false" /><br> </resolver:AttributeDefinition<wbr>><br><br></div>I tried testing this against <a href="http://sp.testshib.org" target="_blank">sp.testshib.org</a> and even changed the scope of eduPersonScopedAffiliation to scope="<a href="http://testshib.org" target="_blank">testshib.org</a>" based on your example, but I didn't see it release. I'm thinking that there's something I don't understand about the idea of a scope.<br><br></div>Thanks<br></div>-Bob<br></div><div class="m_-7654505943379091935HOEnZb"><div class="m_-7654505943379091935h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 15, 2018 at 11:04 AM, IAM David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I think you need the explicit Dependency on the source attribute:<div><br></div><div>Assuming eduPersonAffiliaiton is properly defined elsewhere in attribute-resolver.<br><div><br></div><div>
<span></span>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(181,137,0)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s1" style="color:rgb(88,110,117)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"><AttributeDefinition </span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">id=</span>"eduPersonScopedAffiliation<wbr>"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"> </span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">xsi:type=</span>"Scoped"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(181,137,0)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">scope=</span>"<a href="http://alaska.edu" target="_blank">alaska.edu</a>"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"> </span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">sourceAttributeID=</span>"eduPersonAf<wbr>filiation"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)">></span></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(181,137,0)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s1" style="color:rgb(88,110,117)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span><u><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"><Dependency </span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">ref=</span>"eduPersonAffiliation"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"> /></span></u></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(88,110,117);min-height:11px"><br></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p3" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(38,139,210)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s1" style="color:rgb(88,110,117)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span><AttributeEncoder <span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">xsi:type=</span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s4" style="color:rgb(181,137,0)">"SAML1ScopedString"</span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(181,137,0)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">name=</span>"urn:mace:dir:attribute-d<wbr>ef:eduPersonScopedAffiliation"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"> /></span></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(88,110,117);min-height:11px"><br></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p3" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(38,139,210)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s1" style="color:rgb(88,110,117)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span><AttributeEncoder <span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">xsi:type=</span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s4" style="color:rgb(181,137,0)">"SAML2ScopedString"</span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(181,137,0)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">name=</span>"urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.9"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"> </span><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s3" style="color:rgb(203,75,22)">friendlyName=</span>"eduPersonScopedA<wbr>ffiliation"<span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s2" style="color:rgb(38,139,210)"> /></span></p>
<p class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-p3" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-weight:normal;font-stretch:normal;font-size:10px;line-height:normal;font-family:Menlo;color:rgb(38,139,210)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-s1" style="color:rgb(88,110,117)"><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815gmail-Apple-converted-space"> </span></span></AttributeDefinition></p>
<br></div><div>Sorry I muddied the water with mention of "transient" - I should have written "targeted":</div><div>The idea of targeted id is that to be a different value for every SP, preserving some element of privacy because it doesn't support directly correlating an individual user's activity between SPs.</div><div>So a properly defined targeted id is not going to be a static value from your attribute store, it's going to be ginned up from some source value but deliberately have a different value for each different SP.</div><div><br></div><div>Hope this helps.</div><span class="m_-7654505943379091935m_5983130888149442454HOEnZb"><font color="#888888"><div><br></div><div>David Bantz</div></font></span><div><div class="m_-7654505943379091935m_5983130888149442454h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 15, 2018 at 6:20 AM, Thermal Reboot <span dir="ltr"><<a href="mailto:thermalreboot@gmail.com" target="_blank">thermalreboot@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>I'm hardly an expert and I'm desperately trying to get my head around these concepts, I wish there were an Oreilly book on Shibboleth as I find the website very dry and assumes you know what you want to do.<br><br></div>Here is what I have in attribute-resolver.xml, I assume that's what you want.<br><br> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="eduPersonScopedAffiliation<wbr>" scope="%{idp.scope}" sourceAttributeID="eduPersonAf<wbr>filiation"><br> <resolver:Dependency ref="myLDAP" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedStrin<wbr>g" name="urn:mace:dir:attribute-d<wbr>ef:eduPersonScopedAffiliation" encodeType="false" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedStrin<wbr>g" name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.9" friendlyName="eduPersonScopedA<wbr>ffiliation" encodeType="false" /><br> </resolver:AttributeDefinition<wbr>><br><br></div>As for the eduPersonTargetedID sending a transient, it's a mystery to me.<br><div><br></div><div>Here's my attribute-resolver.xml entry for that:<br><br><resolver:AttributeDefinition xsi:type="ad:SAML2NameID" id="eduPersonTargetedID"<br> nameIdFormat="urn:oasis:names:<wbr>tc:SAML:2.0:nameid-format:pers<wbr>istent" sourceAttributeID="computedID"<wbr>><br> <resolver:Dependency ref="computedID" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.10" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.10" friendlyName="eduPersonTargete<wbr>dID" /><br></resolver:AttributeDefinition<wbr>><br><br><br></div><div>Thanks<br></div><div>-Bob<br></div></div><div class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815HOEnZb"><div class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 14, 2018 at 6:22 PM, IAM David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">An attribute with null value - as explicitly indicated in your log snippet - will not be sent.<div><br><div>You don't include the attribute resolver definition but the earlier log entry indicates an LDAP value of "Staff" which is not scoped.</div><div><br></div><div>I'm not at all clear what you're trying to do in attempting to release a "transient" identifier that has the persistent (i.e., non-transient) value of a directory attribute - isn't that a category mis-match?</div></div><div><br></div><div>David Bantz</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815m_6181636013689368630h5">On Thu, Jun 14, 2018 at 11:48 AM, Thermal Reboot <span dir="ltr"><<a href="mailto:thermalreboot@gmail.com" target="_blank">thermalreboot@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815m_6181636013689368630h5"><div dir="ltr"><div><div><div><div><div>Hello,<br><br></div> I have an SP that requires eduPersonScopedAffiliation and eduPersonTargetedID. To test this I setup my attribute-filter.xml files to deliver these two attributes to <a href="http://sp.testshib.org" target="_blank">sp.testshib.org</a>, but neither of them are being delivered. <br><br></div> I've verified that both attributes are populated in AD and can see that they're being delivered by LDAP:<br><br>2018-06-14 15:00:50,193 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.AbstractDataConnector<wbr>:143] - Data Connector 'myLDAP': Attribute 'eduPersonScopedAffiliation': Values '[StringAttributeValue{value=S<wbr>taff}]'<br><br>2018-06-14 15:00:50,194 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.AbstractDataConnector<wbr>:143] - Data Connector 'myLDAP': Attribute 'eduPersonTargetedID': Values '[StringAttributeValue{value=l<wbr>amother}]'<br><br></div>Yet I also see this:<br><br>2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:372] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'eduPersonScopedAffiliation'<br>2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:388] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'eduPersonScopedAffiliation'<br>2018-06-14 10:21:50,312 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.AbstractAttributeDefi<wbr>nition:245] - Attribute Definition 'eduPersonScopedAffiliation': produced an attribute with no values<br>2018-06-14 10:21:50,313 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'eduPersonScopedAffiliation' produced an attribute with 0 values<br>2018-06-14 10:21:50,353 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:428] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute definition 'eduPersonScopedAffiliation', contains no values<br><br><br></div>And<br><br>2018-06-14 15:00:50,261 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:372] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'eduPersonTargetedID'<br>2018-06-14 15:00:50,264 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:388] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'eduPersonTargetedID'<br>2018-06-14 15:00:50,276 - DEBUG [net.shibboleth.idp.saml.attri<wbr>bute.resolver.impl.SAML2NameID<wbr>AttributeDefinition:153] - Attribute Definition 'eduPersonTargetedID': building a SAML2 NameID with value of 'XgQzYSIOcCKtS8gcaeSXYCyfsfE='<br>2018-06-14 15:00:50,276 - DEBUG [net.shibboleth.idp.saml.attri<wbr>bute.resolver.impl.SAML2NameID<wbr>AttributeDefinition:164] - Attribute Definition 'eduPersonTargetedID': Format set to 'urn:oasis:names:tc:SAML:2.0:n<wbr>ameid-format:persistent'<br>2018-06-14 15:00:50,277 - DEBUG [net.shibboleth.idp.saml.attri<wbr>bute.resolver.impl.SAML2NameID<wbr>AttributeDefinition:172] - Attribute Definition 'eduPersonTargetedID': NameQualifier set to '<a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">https://testshib.umassmed.edu<wbr>/idp/shibboleth</a>'<br>2018-06-14 15:00:50,277 - DEBUG [net.shibboleth.idp.saml.attri<wbr>bute.resolver.impl.SAML2NameID<wbr>AttributeDefinition:182] - Attribute Definition 'eduPersonTargetedID': SPNameQualifier set to '<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/shibb<wbr>oleth-sp</a>'<br>2018-06-14 15:00:50,278 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.AbstractAttributeDefi<wbr>nition:247] - Attribute Definition 'eduPersonTargetedID': produced an attribute with the following values [XMLObjectAttributeValue{value<wbr>=org.opensaml.saml.saml2.core.<wbr>impl.NameIDImpl@d7124d8}]<br>2018-06-14 15:00:50,278 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'eduPersonTargetedID' produced an attribute with 1 values<br>2018-06-14 15:00:50,366 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:434] - Attribute Resolver 'ShibbolethAttributeResolver': De-duping attribute definition eduPersonTargetedID result<br>2018-06-14 15:00:50,366 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.AttributeResolve<wbr>rImpl:446] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute 'eduPersonTargetedID' has 1 values after post-processing<br><br><br></div>My decrypted Assertion at <a href="http://sp.testshib.org" target="_blank">sp.testshib.org</a> looks like:<br><br><pre>2018-06-14 15:41:49 DEBUG Shibboleth.SSO.SAML2 [76]: decrypted Assertion: <saml2:Assertion xmlns:saml2="urn:oasis:names:t<wbr>c:SAML:2.0:assertion" ID="_f8ee0b26b509a4840675be141<wbr>cefd1f0" IssueInstant="2018-06-14T19:41<wbr>:48.238Z" Version="2.0"><saml2:Issuer><a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">ht<wbr>tps://testshib.umassmed.edu/id<wbr>p/shibboleth</a></saml2:Issuer><sa<wbr>ml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAM<wbr>L:2.0:nameid-format:transient" NameQualifier="<a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">https://testshi<wbr>b.umassmed.edu/idp/shibboleth</a>" SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.te<wbr>stshib.org/shibboleth-sp</a>" xmlns:saml2="urn:oasis:names:t<wbr>c:SAML:2.0:assertion">AAlzZWNy<wbr>ZXQ4ODZCiDJKa7lVg5ZzS4KC9fJRKm<wbr>/5M3zTvK1kZ6/O2iqrEfMDjzNgTuD0<wbr>OlQEQgXQdq/CSEVuJmHIAy7+eFJ4bg<wbr>Yz80Znlp0oMPad2nyuLIxI3xqZOIP3<wbr>1dMgqHCaWmYzNvCpG4LL0W5InfUv</<wbr>saml2:NameID><saml2:SubjectCon<wbr>firmation Method="urn:oasis:names:tc:SAM<wbr>L:2.0:cm:bearer"><saml2:Subjec<wbr>tConfirmationData Address="146.189.148.19" InResponseTo="_d3f4f0823fe28c7<wbr>35d62a9ed6d717552" NotOnOrAfter="2018-06-14T19:46<wbr>:48.364Z" Recipient="<a href="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" target="_blank">https://sp.testshib<wbr>.org/Shibboleth.sso/SAML2/POST</a><wbr>"/></saml2:SubjectConfirmation<wbr>></saml2:Subject><saml2:Condit<wbr>ions NotBefore="2018-06-14T19:41:48<wbr>.238Z" NotOnOrAfter="2018-06-14T19:46<wbr>:48.238Z"><saml2:AudienceRestr<wbr>iction><saml2:Audience><a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https:/<wbr>/sp.testshib.org/shibboleth-sp</a><wbr></saml2:Audience></saml2:Audie<wbr>nceRestriction></saml2:Conditi<wbr>ons><saml2:AuthnStatement AuthnInstant="2018-06-14T19:41<wbr>:39.175Z" SessionIndex="_881534154dad964<wbr>ab5923b2ec0e9e355"><saml2:Subj<wbr>ectLocality Address="146.189.148.19"/><sam<wbr>l2:AuthnContext><saml2:AuthnCo<wbr>ntextClassRef>urn:oasis:names:<wbr>tc:SAML:2.0:ac:classes:Passwor<wbr>dProtectedTransport</saml2:Aut<wbr>hnContextClassRef></saml2:Auth<wbr>nContext></saml2:AuthnStatemen<wbr>t><saml2:AttributeStatement><s<wbr>aml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.1920030<wbr>0.100.1.1" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue>Lamothe<wbr>R</saml2:AttributeValue></saml<wbr>2:Attribute><saml2:Attribute FriendlyName="eduPersonPrimary<wbr>Affiliation" Name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.5" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue>Staff</<wbr>saml2:AttributeValue></saml2:A<wbr>ttribute><saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.1920030<wbr>0.100.1.3" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue><a href="mailto:Robert.Lamothe@umassmed.edu" target="_blank">Robert.<wbr>Lamothe@umassmed.edu</a></saml2:At<wbr>tributeValue></saml2:Attribute<wbr>><saml2:Attribute FriendlyName="eduPersonTargete<wbr>dID" Name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.10" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue><saml2:<wbr>NameID Format="urn:oasis:names:tc:SAM<wbr>L:2.0:nameid-format:persistent<wbr>" NameQualifier="<a href="https://testshib.umassmed.edu/idp/shibboleth" target="_blank">https://testshi<wbr>b.umassmed.edu/idp/shibboleth</a>" SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.te<wbr>stshib.org/shibboleth-sp</a>">XgQz<wbr>YSIOcCKtS8gcaeSXYCyfsfE=</saml<wbr>2:NameID></saml2:AttributeValu<wbr>e></saml2:Attribute><saml2:Att<wbr>ribute FriendlyName="displayName" Name="urn:oid:2.16.840.1.11373<wbr>0.3.1.241" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue>Lamothe<wbr>, Robert L</saml2:AttributeValue></saml<wbr>2:Attribute><saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue>Lamothe<wbr></saml2:AttributeValue></saml2<wbr>:Attribute><saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue>Robert<<wbr>/saml2:AttributeValue></saml2:<wbr>Attribute><saml2:Attribute FriendlyName="eduPersonPrincip<wbr>alName" Name="urn:oid:1.3.6.1.4.1.5923<wbr>.1.1.1.6" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue><a href="mailto:lamother@umassmed.edu" target="_blank">lamothe<wbr>r@umassmed.edu</a></saml2:Attribut<wbr>eValue></saml2:Attribute><saml<wbr>2:Attribute FriendlyName="title" Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc<wbr>:SAML:2.0:attrname-format:uri"<wbr>><saml2:AttributeValue>Sr Eng, Sys Admin</saml2:AttributeValue></<wbr>saml2:Attribute></saml2:Attrib<wbr>uteStatement><br></saml2:AttributeStatement></s<wbr>aml2:Assertion><br><br></pre><pre>In the Assertion I see eduPersonTargetedID which looks like it's being set to NameID instead of the AD value,<br></pre><pre>yet I don't see eduPersonScopedAffiliation.<br><br></pre><pre>Am I miss understanding something? Is my config messed up?<br><br></pre><pre>Thanks<br></pre><pre>-Bob<br></pre></div>
<br></div></div><span class="m_-7654505943379091935m_5983130888149442454m_-7111139499208182815m_6181636013689368630HOEnZb"><font color="#888888">-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br></font></span></blockquote></div><br></div>
<br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br></blockquote></div><br></div>
</div></div><br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br></blockquote></div><br></div></div></div></div></div>
<br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br></blockquote></div><br></div>
</div></div><br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br></blockquote></div><br></div>
</div></div><br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>