<div dir="ltr">I think it's a typo:<div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span> </span><RelyingParty id="</span><a href="https://arcgis/" rel="noreferrer" target="_blank" style="color:rgb(17,85,204);background-color:rgb(255,255,255)">https://arcgis</a><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">"</span><br></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">vs</span></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><bean id="singleValueMailSPs" parent="shibboleth.Conditions.</span><span style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">RelyingPartyId"></span><br style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial"><span style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"> ...</span></span></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"> <value></span><a href="https://arcggis/" rel="noreferrer" target="_blank" style="color:rgb(17,85,204)">https://arcggis</a><span style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"></value></span><br style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial"><br></span></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Greg</span></div></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jun 22, 2018 at 9:58 PM Baron Fujimoto <<a href="mailto:baron@hawaii.edu">baron@hawaii.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This looks promising, but apparently I'm missing something.<br>
<br>
I've defined the the predicat in file named activation-condition-predicates.xml based on the the example from the ActivationConditions doc like so:<br>
<br>
<bean id="singleValueMailSPs" parent="shibboleth.Conditions.RelyingPartyId"><br>
<constructor-arg name="candidates"><br>
<list><br>
<value><a href="https://sp.example.com/shibboleth" rel="noreferrer" target="_blank">https://sp.example.com/shibboleth</a></value><br>
<value><a href="https://arcggis" rel="noreferrer" target="_blank">https://arcggis</a></value><br>
</list><br>
</constructor-arg><br>
</bean><br>
<br>
I've used the list version to support potential future expansion.<br>
<br>
I reference this from my services.xml by adding it to the AttributeResolverResources:<br>
(I believe this the the recommended method based on the docs)<br>
<br>
<util:list id ="shibboleth.AttributeResolverResources"><br>
<value>%{idp.home}/conf/attribute-resolver.xml</value><br>
<value>%{idp.home}/conf/activation-condition-predicates.xml</value><br>
</util:list><br>
<br>
It appears to load ok:<br>
<br>
INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/home/shib/idp/conf/activation-condition-predicates.xml]<br>
<br>
I have a test relying party entry which defines the relyingPartyId:<br>
<br>
<RelyingParty id="<a href="https://arcgis" rel="noreferrer" target="_blank">https://arcgis</a>"<br>
provider="<a href="https://idp.hawaii.edu/idp/shibboleth" rel="noreferrer" target="_blank">https://idp.hawaii.edu/idp/shibboleth</a>"<br>
defaultSigningCredentialRef="IdPCredential"><br>
<ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" /><br>
</RelyingParty><br>
<br>
An attribute definition based on your example:<br>
(to release the mail attribute as "arcgis_mail")<br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple"<br>
id="mail" sourceAttributeID="mail"><br>
<resolver:Dependency ref="UH_LDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" activationConditionRef="singleValueMailSPs" name="arcgis_mail" /><br>
<br>
A test attribute filter policy:<br>
<br>
<afp:AttributeFilterPolicy id="ArcGIS"><br>
<afp:PolicyRequirementRule xsi:type="afp:Requester"<br>
value="<a href="https://arcgis" rel="noreferrer" target="_blank">https://arcgis</a>" /><br>
<afp:AttributeRule attributeID="mail"><br>
<afp:PermitValueRule xsi:type="afp:ANY" /><br>
</afp:AttributeRule><br>
<afp:AttributeRule attributeID="givenName"><br>
<afp:PermitValueRule xsi:type="afp:ANY" /><br>
</afp:AttributeRule><br>
</afp:AttributeFilterPolicy><br>
<br>
But when I try a resolver test, it appears to release the attribute as "mail" and not "arcgis_mail"?<br>
<br>
$ curl -k '<a href="https://idp/idp/profile/admin/resolvertest?requester=https://arcgis&principal=baron" rel="noreferrer" target="_blank">https://idp/idp/profile/admin/resolvertest?requester=https://arcgis&principal=baron</a>'<br>
<br>
{<br>
"requester": "<a href="https://arcgis" rel="noreferrer" target="_blank">https://arcgis</a>",<br>
"principal": "baron",<br>
"attributes": [<br>
<br>
<br>
{<br>
"name": "mail",<br>
"values": [<br>
"StringAttributeValue{value=<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>}" ]<br>
},<br>
<br>
{<br>
"name": "givenName",<br>
"values": [<br>
"StringAttributeValue{value=Baron}" ]<br>
}<br>
<br>
]<br>
}<br>
<br>
I don't see any indication in the logs that it's invoking the singleValueMailSPs predicate<br>
or references to arcgis_mail.<br>
<br>
On Mon, Jun 18, 2018 at 02:50:26PM -0700, Greg Haverkamp wrote:<br>
>><br>
>> is there a way to remap a defined attribute's name (id) in an attribute<br>
>> filter policy, or conditionally specify its source attribute in an<br>
>> attribute definition based on the requesting entityID in the attribute<br>
>> resolver? How can we release our single-valued uhEmail attribute to this<br>
>> SP as 'mail' without disrupting our existing definition or release of<br>
>> 'mail' for other SPs already in use? What's the recommended way to handle<br>
>> this?<br>
><br>
><br>
>I haven't decided if it's better or worse, but I've lately started using<br>
>activation conditions for these requests. (Historically, I just created<br>
>new attributes.)<br>
><br>
><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions</a><br>
><br>
>We just go ahead and release by ID, so the poorly implemented SP's get our<br>
>other attributes, too. I gather you could script that out in an Attribute<br>
>Filter Policy if you wanted, but that seems pretty messy.<br>
><br>
>But in our email case:<br>
> <resolver:AttributeDefinition xmlns="urn:mace:shibboleth:2.0:resolver:ad"<br>
>id="email" xsi:type="Simple" sourceAttributeID="mail"><br>
> <resolver:Dependency ref="myLDAP"/><br>
> <resolver:AttributeEncoder<br>
>xmlns="urn:mace:shibboleth:2.0:attribute:encoder" xsi:type="SAML1String"<br>
>name="urn:mace:dir:attribute-def:mail"/><br>
> <resolver:AttributeEncoder<br>
>xmlns="urn:mace:shibboleth:2.0:attribute:encoder" xsi:type="SAML2String"<br>
>name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"/><br>
> <resolver:AttributeEncoder<br>
>xmlns="urn:mace:shibboleth:2.0:attribute:encoder" xsi:type="SAML2String"<br>
>name="email_address" friendlyName="email_address"<br>
>activationConditionRef="CventComPredicate"/><br>
> </resolver:AttributeDefinition><br>
><br>
>Cvent just gets urn:oid:0.9.2342.19200300.100.1.3 and email_address (and a<br>
>handful of others I grumbled about for a bit. Cvent was one of the more<br>
>frustrating integrations I've done in a while.)<br>
><br>
>Greg<br>
><br>
><br>
><br>
>On Mon, Jun 18, 2018 at 2:26 PM Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> wrote:<br>
><br>
>> We are working with an SP (ArcGIS) who in unable to properly handle 'mail'<br>
>> as a potentially multivalued attibute. Normally we would offer an<br>
>> alternate attribute we have defined with id=uhEmail which we guarantee to<br>
>> to be single-valued and encode with the same OID as the sandard mail<br>
>> attribute where this is an issue. However, this SP also insists that this<br>
>> attribute they require be named 'mail'.<br>
>><br>
>> Is there a way to remap a defined attribute's name (id) in an attribute<br>
>> filter policy, or conditionally specify its source attribute in an<br>
>> attribute definition based on the requesting entityID in the attribute<br>
>> resolver? How can we release our single-valued uhEmail attribute to this<br>
>> SP as 'mail' without disrupting our existing definition or release of<br>
>> 'mail' for other SPs already in use? What's the recommended way to handle<br>
>> this?<br>
<br>
-- <br>
Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> :: UH Information Technology Services<br>
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>