<html><body><div dir="ltr">
just checking: you are reloading the attribute-resolver, attribute-registry, and attribute-filter files after updates<br><br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On 22Feb2022 at 13:15:17, Brent Goebel <<a href="mailto:Brent.Goebel@du.edu">Brent.Goebel@du.edu</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div>
<div>
Hi Scott,<br><br>I can change the names being send as you recommended. So I went ahead and made the names unique. I went to the IdP-NEW configuration and updated the attributes to be released to Shib-IdP adding "PG" to the front of them (employeeID changed to PGemployeeID). <br><br>On the Shib-IdP side, I added entries for all the attributes that IdP-NEW would be handing off. Example of employeeID below. I also updated the filter to match the new name. <br><br>Attribute-resolver.xml <br><br> <AttributeDefinition id="PGemployeeID" xsi:type="Simple"><br> <InputAttributeDefinition ref="employeeID" /><br> <AttributeEncoder xsi:type="SAML2String" name="PGemployeeID" encodeType="false"/><br> </AttributeDefinition><br><br><br>Attribute-filter.xml<br><br> <AttributeRule attributeID="PGemployeeID"><br> <PermitValueRule xsi:type="ANY" /><br> </AttributeRule><br><br><br>After doing so, I tried again and I'm still seeing the same results. Is there something else I'm missing? Since I can modify the IdP-NEW side, I'd rather not create custom rules as you suggested. <br><br><br>2022-02-22 15:08:01,729 - 130.253.2.189 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:443] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute 'PGemployeeID'<br><br><br><br>-----Original Message-----<br>From: users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> On Behalf Of Cantor, Scott<br>Sent: Tuesday, February 22, 2022 11:19 AM<br>To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>Subject: [EXTERNAL] Re: Shib IdP Proxying to another IdP help<br><br>On 2/22/22, 1:15 PM, "users on behalf of Brent Goebel" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:Brent.Goebel@du.edu">Brent.Goebel@du.edu</a>> wrote:<br><br><blockquote type="cite"> My apologies, I forgot to provide what I see in the logs. I'm seeing the "No transcoding rule for Attribute"<br></blockquote><blockquote type="cite"> show up for each attribute that is set in the attribute filter for <br></blockquote><blockquote type="cite"> IdP-NEW. It appears to be that second possibility you mentioned, Scott <br></blockquote><blockquote type="cite"> regarding the "decoding rules for the attribute names that are passing into the IdP from the other IdP." Can you please guide me on where to setup these decoding rules? Thanks.<br></blockquote><br>Those are bogus/non-unique/non-standard attribute names, which is why there are no rules for them. And I wouldn't create them, personally, I'd change the names that are being sent, but that's up to you. In any event, the fix is adding custom rules to the attribute registry service. Either XML rulesets or small property files for each rule.<br><br><a href="https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/display/IDP4/AttributeRegistryConfiguration__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW3ibEWl1Q$">https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/display/IDP4/AttributeRegistryConfiguration__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW3ibEWl1Q$</a> <br><br>-- Scott<br><br><br>--<br>For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW19WTCMyw$">https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!NCZxaNi9jForCP_SxBKJCA!HWZvbAYR3VjE2n_6mPNjMs-krJ7wh5RQtgfE53ZtcMfeS5MwucQJWhROiW19WTCMyw$</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>-- <br>For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div>
</div></body></html>