<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">Back in Oct 2022 we added
the config for two new SP instances (same vendor), one instance
for employees and the other for students. When I began config for
these two SPs, we had two previously defined attributes in our
attribute-resolver.xml file they wanted to use:<br>
<br>
<AttributeDefinition xsi:type="Simple" id="employeeID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:1.2.840.113556.1.4.35" friendlyName="employeeID"
/><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple" id="studentID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:1.2.840.113556.1.4.35" friendlyName="studentID"
/><br>
</AttributeDefinition><br>
<br>
They were going to use the two existing attributes to populate on
a user's AcmeLMS profile the username field.<br>
<br>
<br>
Additionally they wanted to populate a unique id field, so we had
to define two more attributes in the our attribute-resolver.xml
file. I'm sure what I did was not the best practice.<br>
<br>
<AttributeDefinition xsi:type="Simple" id="hrNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple" id="saNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
Once things were config'd and SSO was working (verified by the
vendor), in my documentation I always grab aacli output for
historical purposes. Each instance reported:<br>
<br>
EMPLOYEE:<br>
<saml2:AttributeStatement><br>
<saml2:Attribute FriendlyName="employeeID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
NOTE: Notice both a employeeID and uid are in this output.<br>
<br>
STUDENT:<br>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="studentID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">NOTE: Notice both a
employeeID and uid are in this output.<br>
</font><br>
Today the vendor reported that we were sending two values each in
the employeeID and studentID items in the SAML message. I verified
that by running the aacli command against each instance:<br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">EMPLOYEE:<br>
</font> <saml2:Attribute FriendlyName="employeeID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">STUDENT:<br>
</font> <saml2:Attribute FriendlyName="studentID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
<saml2:AttributeValue
xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
Additionally, the uid attribute was not included.<br>
<br>
The following config for these two instances in our
attribute-filter.xml file are:<br>
<br>
<AttributeFilterPolicy id="acmeLMSemp"><br>
<PolicyRequirementRule xsi:type="Requester"
value="urn:vector-solutions:id:sp:jmu-va-vectorlmsedu-com-saml"
/><br>
<AttributeRule
attributeID="employeeID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="givenName"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule attributeID="sn"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="mail"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="hrNumberUID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
<AttributeFilterPolicy id="acmeLMSstu"><br>
<PolicyRequirementRule xsi:type="Requester"
value="urn:vector-solutions:id:sp:jmustudents-va-vectorlmsedu-com-saml"
/><br>
<AttributeRule
attributeID="saNumberUID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="studentID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="givenName"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule attributeID="sn"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="jmustudentemail"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
My un-educated assumption is that since employeeID &
hrNumberUID both have the same urn:oid value and since studentID
& saNumberUID also both have the same urn:oid value, that's
causing the issue of the uid attribute being dropped and the
employeeID (or studentID) containing the same attribute value
twice.<br>
<br>
If I define the attribute-resolver.xml file with a urn:oid value
that better aligns with a userid type attribue
(urn:oid:0.9.2342.19200300.100.1.1) then aacli output returns back
to both employeeID & studentID having a single value and uid
now displaying in the SAML message.<br>
<br>
Asking the vendor if they approximately knew when this issue
started, they reported "started happening over a month ago". One
of the events that happened during mid Janurary was the upgrade of
our Shibboleth IdP from 4.1.7 to 4.2.1. <br>
<br>
I'm being asked to ask if there was anything in the upgrade we
installed that could have resulted in this reported issue? I've
looked at the release notes for the versions (4.2.1, 4.2.0) and
nothing is jumping out at my ignorant eyes.<br>
<br>
Thanks,<br>
Don</font><br>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
</pre>
</body>
</html>