<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I have added OIDC support to our Shibboleth IdP (v4.3.3) and everything appears to work as expected. <o:p></o:p></p>
<p class="MsoNormal">I am trying to pass our serialNumber attribute to the service as oidc_serialNumber. <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Using the scoped configuration below, works as expected and the user’s serialNumber with scope is passed as for example <a href="mailto:P1234567@emory.edu" title="mailto:P1234567@emory.edu">P1234567@emory.edu</a>.<o:p></o:p></p>
<p class="MsoNormal"><b><!-- Works but adds @emory.edu scope --></b><o:p></o:p></p>
<p class="MsoNormal"><AttributeDefinition id="oidc_serialNumber" xsi:type="Scoped" scope="%{idp.scope}"<o:p></o:p></p>
<p class="MsoNormal"> activationConditionRef="shibboleth.oidc.Conditions.PublicRequired"><o:p></o:p></p>
<p class="MsoNormal"> <InputAttributeDefinition ref="serialNumber" /><o:p></o:p></p>
<p class="MsoNormal"> <AttributeEncoder xsi:type="oidc:OIDCScopedString" name="sub" /><o:p></o:p></p>
<p class="MsoNormal"></AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">But what I really need is the just the serialNumber minus the scope.
<o:p></o:p></p>
<p class="MsoNormal">I have tried several configurations without success. <o:p></o:p></p>
<p class="MsoNormal">Here is one example:<o:p></o:p></p>
<p class="MsoNormal"><b><!— Does not work. Nothing is passed for the oidc_serialNumber à</b><o:p></o:p></p>
<p class="MsoNormal"><AttributeDefinition id="oidc_serialNumber" xsi:type="Simple" ><o:p></o:p></p>
<p class="MsoNormal"> <InputAttributeDefinition ref="serialNumber" /><o:p></o:p></p>
<p class="MsoNormal"> <AttributeEncoder xsi:type="oidc:OIDCString" name="oidc_serialNumber" /><o:p></o:p></p>
<p class="MsoNormal"></AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><b>Here is the attribute filter:</b><o:p></o:p></p>
<p class="MsoNormal"> <AttributeFilterPolicy id=" SomeServiceOrgNonProd _OIDC"><o:p></o:p></p>
<p class="MsoNormal"> <PolicyRequirementRule xsi:type="Requester" value="SomeServiceOrgNonProd" /><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <AttributeRule attributeID="oidc_serialNumber"><o:p></o:p></p>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><o:p></o:p></p>
<p class="MsoNormal"> </AttributeRule><o:p></o:p></p>
<p class="MsoNormal"> </AttributeFilterPolicy><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><b>Here is the OIDC json config:</b><o:p></o:p></p>
<p class="MsoNormal"> "client_id": " SomeServiceOrgNonProd ",<o:p></o:p></p>
<p class="MsoNormal"> "response_types": ["code"],<o:p></o:p></p>
<p class="MsoNormal"> "scope": "openid profile email",<o:p></o:p></p>
<p class="MsoNormal"> "redirect_uris": ["<a href="https://someservice.org/.auth/login/nonprod-e2-cod-web-oidc/callback" title="Original URL:
https://someservice.org/.auth/login/nonprod-e2-cod-web-oidc/callback
Click to follow link.">https://someservice.org/.auth/login/nonprod-e2-cod-web-oidc/callback</a>"],<o:p></o:p></p>
<p class="MsoNormal"> "client_secret": "1234567890aaaaa"<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I have also tried just passing the serialNumber which also does not work.
<o:p></o:p></p>
<p class="MsoNormal">I have read the docs here <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879159/OPAttributeResolution">
https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376879159/OPAttributeResolution</a> as well as docs linked to from that page.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I see no errors in the IdP logs. <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">What am I doing wrong?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>