<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">All,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is starting to make sense, and I’m getting enthusiastic about moving my encoders over to the registry soon. But I’m obviously doing something wrong for this attribute that I’m trying to consume from the upstread IdP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I added the properties to services.properties and the attribute registry bean to services.xml. I currently have the line in that bean that loads attributes/default-rules.xml commented out. I decided, since I’m just adding a single attribute,
to put it in a file in attributes/custom. I have conf/attribute-registry.xml uncommented in the bean in services.xml, so files in the custom directory seem to be getting loaded.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My custom attribute registry in a properties file looks like this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">id=adfsProxyAuthnMethod<o:p></o:p></p>
<p class="MsoNormal">transcoder=SAML2StringTranscoder<o:p></o:p></p>
<p class="MsoNormal">saml2.name=http://schemas.microsoft.com/claims/authnmethodsreferences<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I also had encoder=false in there, too, since this attribute is only being decoded from ADFS and used internally, but removing that didn’t solve my problem.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I added a subject data connector to use the attribute:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <DataConnector id="adfsProxy" xsi:type="Subject"<o:p></o:p></p>
<p class="MsoNormal"> relyingParties="%{idp.saml-proxy.entityID}"<o:p></o:p></p>
<p class="MsoNormal"> exportAttributes="adfsProxyAuthnMethod" /><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can tell that my transcoder rule is getting loaded:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2021-10-08 10:36:24,391 - DEBUG [net.shibboleth.idp.attribute.transcoding.impl.TranscodingRuleLoader:87] - Loading rule from property set in file (/opt/shibboleth-idp/conf/attributes/custom/adfsProxyAuthnMethod.properties)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">And<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2021-10-08 10:36:24,566 - DEBUG [net.shibboleth.idp.attribute.transcoding.impl.AttributeTranscoderRegistryImpl:294] - Attribute mapping: adfsProxyAuthnMethod SAML2:{urn:oasis:names:tc:SAML:2.0:attrname-format:uri}http://schemas.microsoft.com/claims/authnmethodsreferences-<
> via SAML2StringAttributeTranscoder<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But when my function runs after the response comes back from ADFS, I get this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2021-10-08 10:37:04,061 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.Validate<o:p></o:p></p>
<p class="MsoNormal">SAMLAuthentication:456] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'http://schemas.m<o:p></o:p></p>
<p class="MsoNormal">icrosoft.com/claims/authnmethodsreferences'<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve got this bean in the helpers custom object that I’m using in my function for the authnContextTranslationStrategyEx hook:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"<o:p></o:p></p>
<p class="MsoNormal"> p:attributeContextLookupStrategy-ref="shibboleth.ChildLookup.PreRequestedAttributeContext"<o:p></o:p></p>
<p class="MsoNormal"> p:useUnfilteredAttributes="true"><o:p></o:p></p>
<p class="MsoNormal"> <property name="attributeValueMap"><o:p></o:p></p>
<p class="MsoNormal"> <map><o:p></o:p></p>
<p class="MsoNormal"> <entry key="adfsProxyAuthnMethod"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <value><a href="http://schemas.microsoft.com/claims/multipleauthn%3c/value">http://schemas.microsoft.com/claims/multipleauthn</value</a>><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </entry><o:p></o:p></p>
<p class="MsoNormal"> </map><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I tried this with both prerequested attributes and without. I wasn’t positive if the attribute resolution ran before the authnContextTranslationStrategyEx hook or not. In addition to wondering why this isn’t mapping my attribute, I’d love
to know if prerequesting the attribute is necessary or not.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What am I missing here?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Michael Grady<br>
<b>Sent:</b> Wednesday, October 6, 2021 5:44 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Resolving attributes from a SAML proxy<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Oct 6, 2021, at 3:36 PM, Wessel, Keith <<a href="mailto:kwessel@illinois.edu">kwessel@illinois.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">I’ll give that a shot, Mike. If I put it in the registry, I don’t need the data connector, right? Just the registry entry and the attribute filter?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Keith<o:p></o:p></p>
</div>
</div>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It depends on why you care about "receiving it". The registry entry is sufficient (I think) to get rid of a warning message about it in the logs, but if you want to actually base some attribute definition logic on it in the resolver, you
would still need the data connector.<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">--<br>
Michael A. Grady<br>
IAM Architect, Unicon, Inc.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>