<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">I understand now.<br>
<br>
Let me disclose that I did some wrong copy/paste actions. In my
original email the following two items should have read:<br>
<br>
<AttributeDefinition xsi:type="Simple"
id="hrNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder xsi:type="SAML2String" name="</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial,
sans-serif">urn:oid:1.2.840.113556.1.4.35</font>"
friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple"
id="saNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder xsi:type="SAML2String" name="</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial,
sans-serif">urn:oid:1.2.840.113556.1.4.35</font>"
friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
...and this is what I change them to:<br>
</font><br>
<font face="Helvetica, Arial, sans-serif"><font face="Helvetica,
Arial, sans-serif"> <AttributeDefinition xsi:type="Simple"
id="hrNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid"
/><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple"
id="saNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid"
/><br>
</AttributeDefinition><br>
<br>
Sorry for the mistake.<br>
<br>
Thanks,<br>
Don<br>
<br>
<br>
<br>
</font></font>
<div class="moz-cite-prefix">On 2/17/23 6:25 PM, Ray Bon wrote:<br>
</div>
<blockquote type="cite" cite="mid:5f40afcfe1d7c8241b04a00a01a7d3d83632b162.camel@uvic.ca">
<b><span style="font-size: 10pt; color: rgb(112, 48, 160);
background: rgb(255, 235, 156);">CAUTION:
</span></b><span style="font-size: 10pt; color: black;
background: rgb(255, 235, 156);">This email originated from
outside of JMU. Do not click links or open attachments unless
you recognize the sender and know the content is safe.</span>
<hr>
<div>
<div>Sorry, that should have been AttributeEncoder, not
AttributeDefinition.</div>
<div>AttributeEncoder ...
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid"</div>
<div>saml2:Attribute FriendlyName="uid"
Name="urn:oid:1.2.840.113556.1.4.35" </div>
<div><br>
</div>
<div><br>
</div>
<div>On Fri, 2023-02-17 at 16:35 -0500, Lohr, Donald A - lohrda
wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex;
border-left:2px #729fcf solid;padding-left:1ex">
<div style="font-size:8pt; color:#f58442 ; font-family:
sans-serif; font-style:normal; font-weight:bold;
padding:.2em">
Notice: This message was sent from outside the University of
Victoria email system. Please be cautious with links and
sensitive information.</div>
<div><br>
</div>
<div><font face="Helvetica, Arial, sans-serif">One instance is
for employees and we are using their HR# to populate<b>uid</b>
and the other instance is for students and we are using
their SIS# to populate<b>uid</b>.<br>
</font><br>
<font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">One instance is for
employees and we are using their HR# to populate<b>employeeID</b>
and the other instance is for students and we are using
their SIS# to populate<b>studentID</b>.<br>
<br>
Since our LDAP service did not have a scheme default for
employeeID and studentID attributes, we created then in
LDAP starting with jmu in their names and I never create
custom attributes in LDAP in upper or mixed case.<br>
<br>
Unless I'm not understanding your question, the
definition and the assertion content are as we expect.<br>
<br>
thx<br>
<br>
</font></font>
<div class="moz-cite-prefix">On 2/17/23 4:15 PM, Ray Bon
wrote:<br>
</div>
<blockquote type="cite" cite="mid:e1da2c7e8c25b1e1b4b5e7f782dce5be25d5a33a.camel@uvic.ca" style="margin:0 0 0 .8ex; border-left:2px #729fcf
solid;padding-left:1ex">
<div><b><span style="font-size: 10pt; color: rgb(112, 48,
160); background: rgb(255, 235, 156);">CAUTION:</span></b><span style="font-size: 10pt; color: black; background:
rgb(255, 235, 156);">This email originated from
outside of JMU. Do not click links or open attachments
unless you recognize the sender and know the content
is safe.</span></div>
<div>
<hr>
</div>
<div>
<div>Donald,</div>
<div><br>
</div>
<div>Your attribute names differ between
AttributeDefinition and AttributeStatement for the uid
friendlyName.</div>
<div>Is this a typo or the actual values?</div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Fri, 2023-02-17 at 14:49 -0500, Lohr, Donald A -
lohrda via users wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex;
border-left:2px #729fcf solid;padding-left:1ex">
<div style="font-size:8pt; color:#f58442 ;
font-family: sans-serif; font-style:normal;
font-weight:bold; padding:.2em">
Notice: This message was sent from outside the
University of Victoria email system. Please be
cautious with links and sensitive information.</div>
<div><br>
</div>
<div><font face="Helvetica, Arial, sans-serif">Back in
Oct 2022 we added the config for two new SP
instances (same vendor), one instance for
employees and the other for students. When I
began config for these two SPs, we had two
previously defined attributes in our
attribute-resolver.xml file they wanted to use:<br>
<br>
<AttributeDefinition xsi:type="Simple"
id="employeeID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder
xsi:type="SAML2String"
name="urn:oid:1.2.840.113556.1.4.35"
friendlyName="employeeID" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple"
id="studentID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder
xsi:type="SAML2String"
name="urn:oid:1.2.840.113556.1.4.35"
friendlyName="studentID" /><br>
</AttributeDefinition><br>
<br>
They were going to use the two existing attributes
to populate on a user's AcmeLMS profile the
username field.<br>
<br>
<br>
Additionally they wanted to populate a unique id
field, so we had to define two more attributes in
the our attribute-resolver.xml file. I'm sure what
I did was not the best practice.<br>
<br>
<AttributeDefinition xsi:type="Simple"
id="hrNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmuemployeeid"/><br>
<AttributeEncoder
xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1"
friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple"
id="saNumberUID"><br>
<InputDataConnector ref="ldap"
attributeNames="jmustudentid"/><br>
<AttributeEncoder
xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1"
friendlyName="uid" /><br>
</AttributeDefinition><br>
<br>
Once things were config'd and SSO was working
(verified by the vendor), in my documentation I
always grab aacli output for historical purposes.
Each instance reported:<br>
<br>
EMPLOYEE:<br>
<saml2:AttributeStatement><br>
<saml2:Attribute
FriendlyName="employeeID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
NOTE: Notice both a employeeID and uid are in this
output.<br>
<br>
STUDENT:<br>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute
FriendlyName="studentID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">NOTE: Notice
both a employeeID and uid are in this output.<br>
</font><br>
Today the vendor reported that we were sending two
values each in the employeeID and studentID items
in the SAML message. I verified that by running
the aacli command against each instance:<br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">EMPLOYEE:<br>
</font> <saml2:Attribute
FriendlyName="employeeID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">8946</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">STUDENT:<br>
</font> <saml2:Attribute
FriendlyName="studentID"
Name="urn:oid:1.2.840.113556.1.4.35"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
<saml2:AttributeValue xmlns:xsd=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBGckk8Isw$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema"</a>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="https://urldefense.com/v3/__http://www.w3.org/2001/XMLSchema-instance__;!!N6YHze6lT7thMl0!L3DRD5vXXQJLyP-4R3h1_cHx3IfV3JKkP7RbFLgJ07NpCMqJSpVGigiETe3GrxwbdIBG-1W5XfE$" moz-do-not-send="true">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xsd:string">101639347</saml2:AttributeValue><br>
</saml2:Attribute><br>
<br>
Additionally, the uid attribute was not included.<br>
<br>
The following config for these two instances in
our attribute-filter.xml file are:<br>
<br>
<AttributeFilterPolicy id="acmeLMSemp"><br>
<PolicyRequirementRule
xsi:type="Requester"
value="urn:vector-solutions:id:sp:jmu-va-vectorlmsedu-com-saml"
/><br>
<AttributeRule
attributeID="employeeID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="givenName"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="sn"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="mail"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="hrNumberUID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
<AttributeFilterPolicy id="acmeLMSstu"><br>
<PolicyRequirementRule
xsi:type="Requester"
value="urn:vector-solutions:id:sp:jmustudents-va-vectorlmsedu-com-saml"
/><br>
<AttributeRule
attributeID="saNumberUID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="studentID"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="givenName"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="sn"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
<AttributeRule
attributeID="jmustudentemail"><PermitValueRule
xsi:type="ANY"/></AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
My un-educated assumption is that since employeeID
& hrNumberUID both have the same urn:oid value
and since studentID & saNumberUID also both
have the same urn:oid value, that's causing the
issue of the uid attribute being dropped and the
employeeID (or studentID) containing the same
attribute value twice.<br>
<br>
If I define the attribute-resolver.xml file with a
urn:oid value that better aligns with a userid
type attribue (urn:oid:0.9.2342.19200300.100.1.1)
then aacli output returns back to both employeeID
& studentID having a single value and uid now
displaying in the SAML message.<br>
<br>
Asking the vendor if they approximately knew when
this issue started, they reported "started
happening over a month ago". One of the events
that happened during mid Janurary was the upgrade
of our Shibboleth IdP from 4.1.7 to 4.2.1.<br>
<br>
I'm being asked to ask if there was anything in
the upgrade we installed that could have resulted
in this reported issue? I've looked at the release
notes for the versions (4.2.1, 4.2.0) and nothing
is jumping out at my ignorant eyes.<br>
<br>
Thanks,<br>
Don</font><br>
</div>
</blockquote>
<div><br>
</div>
<div><span></span></div>
</div>
</blockquote>
<br>
</div>
</blockquote>
<div><br>
</div>
<div><span></span></div>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
</pre>
</body>
</html>