<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><blockquote type="cite" style="text-wrap-mode: wrap;"><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Dear all,
I am trying to setup shibboleth 5.13 using OIDC RP with Entra ID. The setup could authenticate and expose some of the claims from Entra ID to SP without problem.
Now, I would like to expose the groups/roles claim from Entra ID but fail.
I've setup the following transcoding rule for roles claims:
<bean parent="shibboleth.TranscodingProperties">
<property name="properties">
<props merge="true">
<prop key="id">roles</prop>
<prop key="transcoder">OIDCStringTranscoder</prop>
<prop key="oidc.name">roles</prop>
<prop key="oidc.asArray">true</prop>
<prop key="displayName.en">Roles</prop>
<prop key="description.en">Roles</prop>
</props>
</property>
</bean>
attribute-resolver:
<AttributeDefinition xsi:type="SubjectDerivedAttribute"
id="roles"
principalAttributeName="roles">
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:xxx..." friendlyName="roles" encodeType="false" />
</AttributeDefinition>
</pre></blockquote><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Did you also release this using a suitable filter? (see <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#%5BinlineExtension%5DAttribute-Extraction-and-Filtering">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#%5BinlineExtension%5DAttribute-Extraction-and-Filtering</a>)</pre><blockquote type="cite" style="text-wrap-mode: wrap;"><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">
The sample roles claim as array:
Attribute '{"roles":["xxx-..."],["xxx-..."],["xxx-..."],["xxx-..."]}’
</pre></blockquote><span style="text-wrap-mode: wrap;">If this is the actual JSON string, I am not sure it is valid. I would expect it to be more like the following if it is an array of strings: '{"roles":["xxx-…","xxx-…","xxx-…","xxx-..."]}’</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">If your IdP is logging on TRACE, you should be able to see if the transcoder is decoding the ‘roles’ claim e.g. a logging line something like:</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">TRACE [net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder:207] - Beginning to decode claim ‘roles'</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">Can you see that?</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;"><br></span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">Phil<br></span><blockquote type="cite" style="text-wrap-mode: wrap;"><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">
Any idae?
Thanks
Chris</pre></blockquote><span style="text-wrap-mode: wrap;">
</span></pre>
<br class="Apple-interchange-newline">
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice</p>
</font></font>
</body>
</html>