<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">One instance is for
employees and we are using their HR# to populate <b>uid</b> and
the other instance is for students and we are using their SIS# to
populate <b>uid</b>.<br>
</font><br>
<font face="Helvetica, Arial, sans-serif"><font face="Helvetica,
Arial, sans-serif">One instance is for employees and we are
using their HR# to populate <b>employeeID</b> and the other
instance is for students and we are using their SIS# to populate
<b>studentID</b>.<br>
<br>
Since our LDAP service did not have a scheme default for
employeeID and studentID attributes, we created then in LDAP
starting with jmu in their names and I never create custom
attributes in LDAP in upper or mixed case.<br>
<br>
Unless I'm not understanding your question, the definition and
the assertion content are as we expect.<br>
<br>
thx<br>
<br>
</font></font>
<div class="moz-cite-prefix">On 2/17/23 4:15 PM, Ray Bon wrote:<br>
</div>
<blockquote type="cite" cite="mid:e1da2c7e8c25b1e1b4b5e7f782dce5be25d5a33a.camel@uvic.ca">
<b><span style="font-size: 10pt; color: rgb(112, 48, 160);
background: rgb(255, 235, 156);">CAUTION:
</span></b><span style="font-size: 10pt; color: black;
background: rgb(255, 235, 156);">This email originated from
outside of JMU. Do not click links or open attachments unless
you recognize the sender and know the content is safe.</span>
<hr>
<div>
<div>Donald,</div>
<div><br>
</div>
<div>Your attribute names differ between AttributeDefinition and
AttributeStatement for the uid friendlyName.</div>
<div>Is this a typo or the actual values?</div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Fri, 2023-02-17 at 14:49 -0500, Lohr, Donald A - lohrda
via users wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex;
border-left:2px #729fcf solid;padding-left:1ex">
<div style="font-size:8pt; color:#f58442 ; font-family:
sans-serif; font-style:normal; font-weight:bold;
padding:.2em">
Notice: This message was sent from outside the University of
Victoria email system. Please be cautious with links and
sensitive information.</div>
<div><br>
</div>
<div><font face="Helvetica, Arial, sans-serif">Back in Oct
2022 we added the config for two new SP instances (same
vendor), one instance for employees and the other for
students. When I began config for these two SPs, we had
two previously defined attributes in our
attribute-resolver.xml file they wanted to use:<br>
<br>
<AttributeDefinition xsi:type="Simple"
id="employeeID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:1.2.840.113556.1.4.35"
friendlyName="employeeID" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple"
id="studentID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:1.2.840.113556.1.4.35"
friendlyName="studentID" /><br>
</AttributeDefinition><br>
<br>
They were going to use the two existing attributes to
populate on a user's AcmeLMS profile the username field.<br>
<br>
<br>
Additionally they wanted to populate a unique id field, so
we had to define two more attributes in the our
attribute-resolver.xml file. I'm sure what I did was not
the best practice.<br>
<br>
<AttributeDefinition xsi:type="Simple"
id="hrNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1"
friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple"
id="saNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1"
friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
Once things were config'd and SSO was working (verified by
the vendor), in my documentation I always grab aacli
output for historical purposes. Each instance reported:<br>
<br>
EMPLOYEE:<br>
<saml2:AttributeStatement><br>
<saml2:Attribute FriendlyName="employeeID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
NOTE: Notice both a employeeID and uid are in this output.<br>
<br>
STUDENT:<br>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="studentID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">NOTE: Notice both a
employeeID and uid are in this output.<br>
</font><br>
Today the vendor reported that we were sending two values
each in the employeeID and studentID items in the SAML
message. I verified that by running the aacli command
against each instance:<br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">EMPLOYEE:<br>
</font> <saml2:Attribute
FriendlyName="employeeID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">STUDENT:<br>
</font> <saml2:Attribute
FriendlyName="studentID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
Additionally, the uid attribute was not included.<br>
<br>
The following config for these two instances in our
attribute-filter.xml file are:<br>
<br>
<AttributeFilterPolicy id="acmeLMSemp"><br>
<PolicyRequirementRule xsi:type="Requester"
value="urn:vector-solutions:id:sp:jmu-va-vectorlmsedu-com-saml"
/><br>
<AttributeRule
attributeID="employeeID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="givenName"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="sn"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="mail"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="hrNumberUID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
<AttributeFilterPolicy id="acmeLMSstu"><br>
<PolicyRequirementRule xsi:type="Requester"
value="urn:vector-solutions:id:sp:jmustudents-va-vectorlmsedu-com-saml"
/><br>
<AttributeRule
attributeID="saNumberUID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="studentID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="givenName"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="sn"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="jmustudentemail"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
My un-educated assumption is that since employeeID &
hrNumberUID both have the same urn:oid value and since
studentID & saNumberUID also both have the same
urn:oid value, that's causing the issue of the uid
attribute being dropped and the employeeID (or studentID)
containing the same attribute value twice.<br>
<br>
If I define the attribute-resolver.xml file with a urn:oid
value that better aligns with a userid type attribue
(urn:oid:0.9.2342.19200300.100.1.1) then aacli output
returns back to both employeeID & studentID having a
single value and uid now displaying in the SAML message.<br>
<br>
Asking the vendor if they approximately knew when this
issue started, they reported "started happening over a
month ago". One of the events that happened during mid
Janurary was the upgrade of our Shibboleth IdP from 4.1.7
to 4.2.1.<br>
<br>
I'm being asked to ask if there was anything in the
upgrade we installed that could have resulted in this
reported issue? I've looked at the release notes for the
versions (4.2.1, 4.2.0) and nothing is jumping out at my
ignorant eyes.<br>
<br>
Thanks,<br>
Don</font><br>
</div>
</blockquote>
<div><br>
</div>
<div><span></span></div>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
</pre>
</body>
</html>