<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Hello Shib folks,</span><br>
</div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div class="x_x_x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_x_x_PlainText"><br>
I have an issue with affiliation attribute extraction. 2 similar setup (entity ID & cert are different) yields different attribute scoping: in only one of the 2 setup the attribute we rely on for logging in a person is removed by the AttributeFilter.<br>
<br>
# Context:<br>
I manage an SP, I have a customer with issues connecting their IdP with our SP. <br>
The customer has 2 IdP, one for test, one for prod, which are both registered with my SP.<br>
The metadata for the IdP is the same with exception of the URL & entity ID.<br>
<br>
When login with the test IdP, my SP retrieves 2 values from the affiliation attribute.
<br>
When login with the prod IdP, my SP drops one of the 2 values (of course the one we need) from the affiliation attribute.
<br>
In the Shib Session page, the prod IdP session has the following affiliation:<br>
affiliation: mainaffiliation@example.edu.ex<br>
<br>
And the test IdP:<br>
affiliation: mainaffiliation@example.edu.ex;secondaryaffiliation@other-example.net<br>
<br>
My question is: Where is this filtering configured to create this problem ? What additional steps should me or my customer do to figure out this issue ?<br>
<br>
I've reviewed my attribute-policy.xml, but since the same attribute (exact same value) passes the filtering in one of the 2 setup, I doubt that this is the issue.
<br>
I'm wondering if this is linked to the shibmd:Scope extension regex, but I did some testing with different values (updating IdP MD with static values, and allow all regex) without solving this problem.<br>
<br>
We've tested in 2 shibboleth SP setup (one running shib 2.3 and one 2.5 and yes, we're upgrading).<br>
<br>
Below is some info regarding the Session, logs and metadata info.<br>
<br>
# IdP Metadata excerpt (same for both except for signing certs & entity ID)<br>
<IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0"><br>
<Extensions><br>
<shibmd:Scope regexp="true">^(.*\.)?(example\.edu\.ex|other-example\.net)$</shibmd:Scope><br>
[...]<br>
</Extensions><br>
[...]<br>
<AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol"><br>
<Extensions><br>
<shibmd:Scope regexp="true">^(.*\.)?(example\.edu\.ex|other-example\.net)$</shibmd:Scope><br>
</Extensions><br>
[...]<br>
<br>
# Prod SP logs<br>
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting issuer from SAML 2.0 assertion<br>
DEBUG Shibboleth.SSO.SAML2 [29639]: SSO profile processing completed successfully<br>
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting pushed attributes...<br>
DEBUG Shibboleth.AttributeDecoder.String [29639]: decoding SimpleAttribute (uid) from SAML 2 Attribute (urn:oid:0.9.2342.19200300.100.1.1) with 1 value(s)<br>
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (affiliation) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.9) with 2 value(s)<br>
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)<br>
DEBUG Shibboleth.AttributeFilter [29639]: filtering 3 attribute(s) from (<a href="https://idp1.example.edu.ex/idp/shibboleth">https://idp1.example.edu.ex/idp/shibboleth</a>)<br>
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (uid) from (<a href="https://idp1.example.edu.ex/idp/shibboleth">https://idp1.example.edu.ex/idp/shibboleth</a>)<br>
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (affiliation) from (<a href="https://idp1.example.edu.ex/idp/shibboleth">https://idp1.example.edu.ex/idp/shibboleth</a>)<br>
WARN Shibboleth.AttributeFilter [29639]: removed value at position (1) of attribute (affiliation) from (<a href="https://idp1.example.edu.ex/idp/shibboleth">https://idp1.example.edu.ex/idp/shibboleth</a>)<br>
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (eppn) from (<a href="https://idp1.example.edu.ex/idp/shibboleth">https://idp1.example.edu.ex/idp/shibboleth</a>)<br>
<br>
# Test SP Logs<br>
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting issuer from SAML 2.0 assertion<br>
DEBUG Shibboleth.SSO.SAML2 [29639]: SSO profile processing completed successfully<br>
DEBUG Shibboleth.SSO.SAML2 [29639]: extracting pushed attributes...<br>
DEBUG Shibboleth.AttributeDecoder.String [29639]: decoding SimpleAttribute (uid) from SAML 2 Attribute (urn:oid:0.9.2342.19200300.100.1.1) with 1 value(s)<br>
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (affiliation) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.9) with 2 value(s)<br>
DEBUG Shibboleth.AttributeDecoder.Scoped [29639]: decoding ScopedAttribute (eppn) from SAML 2 Attribute (urn:oid:1.3.6.1.4.1.5923.1.1.1.6) with 1 value(s)<br>
DEBUG Shibboleth.AttributeFilter [29639]: filtering 3 attribute(s) from (<a href="https://idptest.ad.example.edu.ex/idp/shibboleth">https://idptest.ad.example.edu.ex/idp/shibboleth</a>)<br>
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (uid) from (<a href="https://idptest.ad.example.edu.ex/idp/shibboleth">https://idptest.ad.example.edu.ex/idp/shibboleth</a>)<br>
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (affiliation) from (<a href="https://idptest.ad.example.edu.ex/idp/shibboleth">https://idptest.ad.example.edu.ex/idp/shibboleth</a>)<br>
DEBUG Shibboleth.AttributeFilter [29639]: applying filtering rule(s) for attribute (eppn) from (<a href="https://idptest.ad.example.edu.ex/idp/shibboleth">https://idptest.ad.example.edu.ex/idp/shibboleth</a>)<br>
DEBUG Shibboleth.SSO.SAML2 [29639]: resolving attributes...<br>
<br>
<br>
<br>
# Prod Session<br>
Miscellaneous<br>
Session Expiration (barring inactivity): 479 minute(s)<br>
Client Address: (obfuscated)<br>
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol<br>
Identity Provider: <a href="https://idp1.example.edu.ex/idp/shibboleth">https://idp1.example.edu.ex/idp/shibboleth</a><br>
Authentication Time: 2018-06-21T19:29:51.467Z<br>
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<br>
Authentication Context Decl: (none)<br>
<br>
Attributes<br>
affiliation: mainaffiliation@example.edu.ex<br>
eppn: someuser@example.edu.ex<br>
uid: someuser<br>
<br>
<br>
# Test Session<br>
Miscellaneous<br>
Session Expiration (barring inactivity): 479 minute(s)<br>
Client Address: (obfuscated)<br>
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol<br>
Identity Provider: <a href="https://idptest.ad.example.edu.ex/idp/shibboleth">https://idptest.ad.example.edu.ex/idp/shibboleth</a><br>
Authentication Time: 2018-06-21T19:31:05.557Z<br>
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<br>
Authentication Context Decl: (none)<br>
<br>
Attributes<br>
affiliation: mainaffiliation@example.edu.ex;secondaryaffiliation@other-example.net<br>
eppn: someuser@example.edu.ex<br>
uid: someuser<br>
<br>
<br>
# Assertion decrypted on the SP for Prod IdP<br>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="(obfuscated)" IssueInstant="2018-06-07T17:59:21.724Z" Version="2.0"><br>
<saml2:Issuer>https://idp1.example.edu.ex/idp/shibboleth</saml2:Issuer><br>
[...]<br>
<saml2:AttributeStatement><br>
<saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue>someuser</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue>mainaffiliation@example.edu.ex</saml2:AttributeValue><br>
<saml2:AttributeValue>secondaryaffiliation@other-example.net</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue>someuser@example.edu.ex</saml2:AttributeValue><br>
</saml2:Attribute><br>
</saml2:AttributeStatement><br>
</saml2:Assertion><br>
<br>
# Assertion decrypted on the SP for test IdP<br>
<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="(obfuscated)" IssueInstant="2018-06-07T19:13:46.523Z" Version="2.0"><br>
<saml2:Issuer>https://idptest.ad.example.edu.ex/idp/shibboleth</saml2:Issuer><br>
[...]<br>
<saml2:AttributeStatement><br>
<saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue>someuser</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue>mainaffiliation@example.edu.ex</saml2:AttributeValue><br>
<saml2:AttributeValue>secondaryaffiliation@other-example.net</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue>someuser@example.edu.ex</saml2:AttributeValue><br>
</saml2:Attribute><br>
</saml2:AttributeStatement><br>
</saml2:Assertion><br>
<br>
--<br>
Thomas Blanchard<br>
</div>
</span></font></div>
</div>
</div>
</div>
</body>
</html>