<div dir="ltr"><div>Thanks, Peter. I've done some more digging and changed some things, but still stuck. (see below)</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jul 26, 2019 at 3:19 AM Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* Mike Osterman <<a href="mailto:ostermmg@whitman.edu" target="_blank">ostermmg@whitman.edu</a>> [2019-07-26 06:45]:<br>
> After some digging around, I found the documentation to do a Regex match in<br>
> the Requester URL:<br>
> <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/RequesterRegexConfiguration</a><br>
> <br>
> And came up with this:<br>
>     <AttributeFilterPolicy id="BambooHR-SAML"><br>
>         <PolicyRequirementRule xsi:type="RequesterRegex" regex="^<br>
> <a href="https://whitmansandbox.bamboohr.com/.*$" rel="noreferrer" target="_blank">https://whitmansandbox.bamboohr.com/.*$</a>" /><br>
<br>
Regexes shouldn't be necessary. I'm guessing your tenant SP is only<br>
that: One (1) SP with one (1) unchanging entityID. Just providing the<br>
correct entityID there (cf. the metadata you added for that SP) should<br>
suffice?<br>
But either way it still doesn't match:<br></blockquote><div><br></div><div>You're right - I dug into the metadata file in $IDP_HOME/metadata/ and it advertises a URL without a wildcard:</div><div>        <md:EntityDescriptor<br>                                        entityID="BambooHR-SAML"><br>                <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>                        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br>                        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>                                                                        Location="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php">https://whitmansandbox.bamboohr.com/saml/consume.php</a>"<br>                                                                        index="0"<br>                                                                        isDefault="true"/><br>                </md:SPSSODescriptor><br>        </md:EntityDescriptor><br></div><div> </div><div>So I've updated my attribute filter policy, and removed the entityID from the policy id attribute, just to make the logs easier to read:</div><div><br></div><div>    <AttributeFilterPolicy id="bamboohr"><br>        <PolicyRequirementRule xsi:type="Requester" value="<a href="https://whitmansandbox.bamboohr.com/saml/consume.php">https://whitmansandbox.bamboohr.com/saml/consume.php</a>" /><br>        <AttributeRule attributeID="mail"><br>            <PermitValueRule xsi:type="ANY" /><br>        </AttributeRule><br>    </AttributeFilterPolicy></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
> causing the<br>
> net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator<br>
> messages in lines 32-33 here: </blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
> <a href="https://gist.github.com/ostertoaster/3d322c8d2c9a48d9f8c3bb34cd7e12d0" rel="noreferrer" target="_blank">https://gist.github.com/ostertoaster/3d322c8d2c9a48d9f8c3bb34cd7e12d0</a><br>
<br>
Line 11 already states that the policy didn't apply, hence no<br>
attributes and no attribute-sourced NameID:<br>
<br>
> Attribute Filter Policy 'BambooHR-SAML'  Policy is not active for this request</blockquote><div><br></div><div>And yet still, same result - see line 5:</div><div><a href="https://gist.github.com/ostertoaster/740cb2174bafe3679a00aceb5e24cb72">https://gist.github.com/ostertoaster/740cb2174bafe3679a00aceb5e24cb72</a><br></div><div><br></div><div>The only thing I didn't explicitly state is it only supports NameID (yeah, I know it sucks), but my understanding is I still need to release the 'mail' attribute so it can be released through NameID format. </div><div><br></div><div>They also support Google Sign-In, but I *really* don't want to go that route, nor do I think our ISO wants to.</div><div><br></div><div>Thanks,</div><div>Mike</div></div></div>