<div dir="ltr">Hi All<div>Thanks again for your help Peter. I was able to get the Shibboleth attributes in my controller. After all the path was wrong (it should have read /view and not /attributes/view since my app was deployed to attributes).</div><div>Best wishes</div><div>Ana</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 15, 2021 at 10:32 AM Ana Sustic <<a href="mailto:ana@sustic.com">ana@sustic.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Peter<div>Thanks so much for your detailed answer.</div><div><br></div><div>You were correct in saying something was not correct between the SP and IDP. That is working correctly now and in this is what /Shibboleth.sso/Session returns after I authenticate:</div><div><pre><u>Miscellaneous</u>
<strong>Session Expiration (barring inactivity):</strong> 479 minute(s)
<strong>Client Address:</strong> 130.60.114.82
<strong>SSO Protocol:</strong> urn:oasis:names:tc:SAML:2.0:protocol
<strong>Identity Provider:</strong> <a href="https://hostname/idp/shibboleth" target="_blank">https://hostname/idp/shibboleth</a>
<strong>Authentication Time:</strong> 2021-09-15T07:14:11.975Z
<strong>Authentication Context Class:</strong> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
<strong>Authentication Context Decl:</strong> (none)
<u>Attributes</u>
<strong>affiliation</strong>: 1 value(s)
<strong>eduPersonUniqueId</strong>: 1 value(s)
<strong>givenName</strong>: 1 value(s)
<strong>homeOrganization</strong>: 1 value(s)
<strong>homeOrganizationType</strong>: 1 value(s)
<strong>mail</strong>: 1 value(s)
<strong>persistent-id</strong>: 1 value(s)
<strong>scoped-affiliation</strong>: 1 value(s)
<strong>surname</strong>: 1 value(s)
</pre>I am using Apache Tomcat/7.0.76 and HTTP Reverse Proxying. I am not sure what you mean when you say "looping over all attributes may not work". I apologise if this was already asked on the mailing list. I am new to the list.</div><div><br></div><div>When I now access the protected resource and authenticate to the IdP I get the response from the ErrorController as if the mapping for my resource would not exist.</div><div><br></div><pre style="color:rgb(8,8,8);font-family:"JetBrains Mono",monospace;font-size:9.8pt"><span style="color:rgb(158,136,13)">@Controller<br></span><span style="color:rgb(0,51,179)">public class </span><span style="color:rgb(0,0,0)">AppErrorController </span><span style="color:rgb(0,51,179)">implements </span><span style="color:rgb(0,0,0)">ErrorController</span>{<br> <span style="color:rgb(0,51,179)">private final static </span><span style="color:rgb(0,0,0)">String </span><span style="color:rgb(135,16,148);font-style:italic">PATH </span>= <span style="color:rgb(6,125,23)">"/error"</span>;<br> <span style="color:rgb(158,136,13)">@Override<br></span><span style="color:rgb(158,136,13)"> @RequestMapping</span>(<span style="color:rgb(135,16,148);font-style:italic">PATH</span>)<br> <span style="color:rgb(158,136,13)">@ResponseBody<br></span><span style="color:rgb(158,136,13)"> </span><span style="color:rgb(0,51,179)">public </span><span style="color:rgb(0,0,0)">String </span><span style="color:rgb(0,98,122)">getErrorPath</span>() {<br> <span style="color:rgb(140,140,140);font-style:italic">// </span><span style="color:rgb(0,141,222);font-style:italic">TODO Auto-generated method stub<br></span><span style="color:rgb(0,141,222);font-style:italic"> </span><span style="color:rgb(0,51,179)">return </span><span style="color:rgb(6,125,23)">"No Mapping Found"</span>;<br> }<br></pre><div><span style="color:rgb(8,8,8);font-family:"JetBrains Mono",monospace;font-size:9.8pt">}</span></div><div><br></div><div>Thanks and best regards</div><div>Ana</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 14, 2021 at 9:09 PM Peter Schober <<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* Ana Sustic <<a href="mailto:ana@sustic.com" target="_blank">ana@sustic.com</a>> [2021-09-14 20:28]:<br>
> I have a spring boot application running on Apache Tomcat/<a href="http://7.0.76." rel="noreferrer" target="_blank">7.0.76.</a><br>
> Shibboleth SP is running on Apache server. The resource<br>
> /attributes/view is secured using shibboleth.<br>
<br>
Then first verify that the Apache httpd (and IDP) side of things are<br>
working as expected.<br>
Your /Shibboleth.sso/Session not showing any attributes is not a good<br>
sign and simply means you can't expect anything after that, i.e.,<br>
Tomcat, to show any attributes.<br>
<br>
> I have no previous experience with Shibboleth secured resources and<br>
> would like to get the attributes in my application.<br>
<br>
The Shib SP write its ownlog files so that's where you'd look next.<br>
transaction.log has successfully mapped attributes (probably none<br>
at this point), shibd.log has everything else.<br>
<br>
> This is my controller:<br>
<br>
The Java doesn't factor into this, yet.<br>
<br>
(And looping over all attributes may not work, either, as discussed<br>
numerous times on this list. That's meant for later, once you have<br>
your web server and/or the IDP configured correctly and the Shib SP is<br>
showing attributes.<br>
Also for later is that you didn't mention how you integrated Apache<br>
httpd and Tomcat -- via AJP or HTTP Reverse Proxying -- and what<br>
Tomcat version that is. But, again, let's keep that until you have<br>
attributes showing up in the SP.)<br>
<br>
> Attributes<br>
<br>
All we know so far is that the SP has no attributes available.<br>
That can have many reasons, maybe the IDP is not sending any or<br>
the SP is not configured to look for the ones the IDP is sending.<br>
<br>
If the IDP doesn't encrypt the SAML Response (or Assertion) you can<br>
see the SAML in the clear in your browser which is easiest using the<br>
SAML-Tracer extension for Firefox or Chromium/Chrome.<br>
If the Resopnse or Assertion is encrypted then ask the IDP what<br>
exactly they are sending.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>
</blockquote></div>