<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hello Nate, </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Thanks very much your assistance.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Once the entries that you specified were added, I was able to see the attributes and I was able to get the application to work.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Best regards, </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Lee Matthews</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;"><b>From:</b> Nate Klingenstein <ndk@signet.id><br>
<b>Sent:</b> Wednesday, March 31, 2021 3:36 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net>; users@shibboleth.net <users@shibboleth.net><br>
<b>Cc:</b> Matthews, Lee (NIH/NIDDK) [E] <lee.matthews@nih.gov><br>
<b>Subject:</b> RE: Not getting attributes</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Lee,<br>
<br>
> 2021-03-31 14:03:09 INFO Shibboleth.AttributeExtractor.XML [1] [default]: skipping SAML 2.0 Attribute with Name: email address, Format:urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified<br>
<br>
All attribute Names are presumed in the default configuration to be specification-compliant, and all the attributes' NameFormats are defaulted to urn:oasis:names:tc:SAML:2.0:attrname-format:uri. You can add your own attributes, of course, but they should
use attributes that are declared in a namespace that you own and using a NameFormat that is, well, actually specified. As it is, your "email address" would be highly likely to collide with someone else's email address, and they may have completely different
semantics, such as which characters are permitted and whether multiple values are allowed. It's best to use a standard attribute if possible, and if not, define your own and make that definition clear, and when confronted by this, bite the bullet and map
the attribute anyway.<br>
<br>
> I am not sure what I am missing.<br>
<br>
Attributes mappings. Keeping in mind all the above about this being a bad set of attributes, you can accept the attributes that you're receiving right now without any modification to the IdP by adding the following to /etc/shibboleth/attribute-map.xml:<br>
<br>
<Attribute name="email address" id="mail" /><br>
<Attribute name="FirstName" id="firstName" /><br>
<Attribute name="LastName" id="lastName /><br>
<Attribute name="eduperson Principal Name" id="eduPersonPrincipalName" /><br>
<br>
Note that the last one is particularly ugly, since it does have a well-specified and widely-used SAML and LDAP name, but it'll work.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SP3/XMLAttributeExtractorExamples">https://wiki.shibboleth.net/confluence/display/SP3/XMLAttributeExtractorExamples</a><br>
<br>
I'm not entirely sure that you can have spaces in an attribute name, but you probably can. I haven't validated that unspecified attribute NameFormats are passed through, but the Wiki is my holy book, and I follow its writings to the Cantor 3:21.<br>
<br>
The better long-term fix would be for the IdP to release standard attribute names, but I fully understand what a challenge that is.<br>
<br>
Best,<br>
Nate.<br>
<br>
--------<br>
Signet, Inc.<br>
The Art of Access ®<br>
<br>
<a href="https://www.signet.id">https://www.signet.id</a><br>
</div>
</span></font></div>
</div>
</body>
</html>