<div dir="ltr">Hi Ray, <div><br></div><div>This is:</div><div><br></div><div><?xml version="1.0" encoding="UTF-8"?><br><br><AttributeResolver<br> xmlns="urn:mace:shibboleth:2.0:resolver"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver <a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd</a>"><br><br><br> <!-- ========================================== --><br> <!-- Attribute Definitions --><br> <!-- ========================================== --><br><br><br> <!-- Use AD LDS objectGUID for ImmutableID --><br> <AttributeDefinition id="ImmutableID" xsi:type="Simple" sourceAttributeID="userPrincipalName"><br> <Dependency ref="myLDAP" /><br> </AttributeDefinition><br><br> <!-- mail for Azure AD User ID --><br> <AttributeDefinition id="UserId" xsi:type="Simple" sourceAttributeID="mail"><br> <Dependency ref="myLDAP" /><br> <AttributeEncoder xsi:type="SAML2String" name="IDPEmail" friendlyName="UserId" /><br> </AttributeDefinition><br></div><div><br></div><div><br></div><div><!--<br> The EPPN is the "standard" federated username in higher ed.<br> For guidelines on the implementation of this attribute, refer<br> to the Shibboleth and eduPerson documentation. Above all, do<br> not expose a value for this attribute without considering the<br> long term implications.<br> --><br> <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped" scope="%{idp.scope}"><br> <InputAttributeDefinition ref="uid" /><br> <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" /><br> </AttributeDefinition><br><br> <!--<br> The uid is the closest thing to a "standard" LDAP attribute<br> representing a local username, but you should generally *never*<br> expose uid to federated services, as it is rarely globally unique.<br> --><br> <AttributeDefinition id="uid" xsi:type="PrincipalName"><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" /><br> </AttributeDefinition><br><br> <!--<br> In the rest of the world, the email address is the standard identifier,<br> despite the problems with that practice. Consider making the EPPN<br> value the same as your official email addresses whenever possible.<br> --><br> <AttributeDefinition id="mail" xsi:type="Template"><br> <InputAttributeDefinition ref="uid" /><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /><br> <Template><br> <![CDATA[<br> ${<a href="mailto:uid%7D@example.org">uid}@example.org</a><br> ]]><br> </Template><br> <SourceAttribute>uid</SourceAttribute><br> </AttributeDefinition><br><br> <!--<br> This is an example of an attribute sourced from a data connector.<br> --><br> <AttributeDefinition id="eduPersonScopedAffiliation" xsi:type="Scoped" scope="%{idp.scope}"><br> <InputDataConnector ref="staticAttributes" attributeNames="affiliation" /><br> <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" friendlyName="eduPersonScopedAffiliation" encodeType="false" /><br> </AttributeDefinition><br><br><br> <!-- ========================================== --><br> <!-- Data Connectors --><br> <!-- ========================================== --><br></div><div><br></div><div><br></div><div> <DataConnector id="staticAttributes" xsi:type="Static"><br> <Attribute id="affiliation"><br> <Value>member</Value><br> </Attribute><br> </DataConnector><br><br> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:false}"<br> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<br> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"><br> <dc: FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </dc:FilterTemplate><br> <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectGUID" /><br> <ConnectionPool<br> minPoolSize="%{idp.pool.LDAP.minSize:3}"<br> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<br> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"<br> failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" /><br> </DataConnector><br><br></AttributeResolver><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>Thanks !!</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">El jue., 12 mar. 2020 a las 13:55, Ray Bon (<<a href="mailto:rbon@uvic.ca">rbon@uvic.ca</a>>) escribió:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div style="text-align:left;direction:ltr">
<div>Gustavo,</div>
<div><br>
</div>
<div>What is your attribute resolver config?</div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Thu, 2020-03-12 at 13:15 -0300, Gustavo Duarte wrote:</div>
<blockquote type="cite" style="margin:0px 0px 0px 0.8ex;border-left:2px solid rgb(114,159,207);padding-left:1ex">
<div style="font-size:8pt;color:rgb(245,132,66);font-family:sans-serif;font-style:normal;font-weight:bold;padding:0.2em">
Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.
</div>
<br>
<div>
<div dir="ltr">Hi all,<br>
<br>
I'm configuring a Federated domain in my AAD (Azue Active Directory) to be authenticated on my Shibboleth IDP.<br>
<br>
On IDP side i configured the user with LDAP.<br>
<br>
First a i tested this user with <a href="https://samltest.id/" target="_blank">https://samltest.id/</a> online tool and all work fine.<br>
<br>
When try login with this same user on: <a href="https://portal.office.com/" target="_blank">https://portal.office.com/</a> i' redirected to shib IDP login and after write user/pass, following error is showed on browser:
<div><br>
AADSTS500082: SAML assertion is not present in the token.<br>
<br>
And in my shib idp log the following error is showed.</div>
<div><br>
Profile Action ResolveAttributes: Error resolving attributes: Invalid Attribute resolver configuration</div>
<div><br>
</div>
<div>What is happening, here ?</div>
<div><br>
</div>
<div>Thanks in advance.</div>
</div>
</div>
</blockquote>
<div><span>
<pre>-- <br></pre>
<div>Ray Bon</div>
<div>Programmer Analyst</div>
<div>Development Services, University Systems</div>
<div>2507218831 | CLE 019 | <a href="mailto:rbon@uvic.ca" target="_blank">rbon@uvic.ca</a></div>
<div><br>
</div>
<div>I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations.</div>
</span></div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>