<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><blockquote type="cite" style="text-wrap-mode: wrap;"><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Dear all,

I am trying to setup shibboleth 5.13 using OIDC RP with Entra ID.   The setup could authenticate and expose some of the claims from Entra ID to SP without problem.

Now, I would like to expose the groups/roles claim from Entra ID but fail.

I've setup the following transcoding rule for roles claims:

        <bean parent="shibboleth.TranscodingProperties">
            <property name="properties">
                <props merge="true">
                    <prop key="id">roles</prop>
                    <prop key="transcoder">OIDCStringTranscoder</prop>
                    <prop key="oidc.name">roles</prop>
                    <prop key="oidc.asArray">true</prop>
                    <prop key="displayName.en">Roles</prop>
                    <prop key="description.en">Roles</prop>
                </props>
            </property>
        </bean>

attribute-resolver:

    <AttributeDefinition xsi:type="SubjectDerivedAttribute"
            id="roles"
            principalAttributeName="roles">
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:xxx..." friendlyName="roles" encodeType="false" />
    </AttributeDefinition>
</pre></blockquote><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Did you also release this using a suitable filter? (see <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#%5BinlineExtension%5DAttribute-Extraction-and-Filtering">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#%5BinlineExtension%5DAttribute-Extraction-and-Filtering</a>)</pre><blockquote type="cite" style="text-wrap-mode: wrap;"><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">

The sample roles claim as array:

Attribute '{"roles":["xxx-..."],["xxx-..."],["xxx-..."],["xxx-..."]}’
</pre></blockquote><span style="text-wrap-mode: wrap;">If this is the actual JSON string, I am not sure it is valid. I would expect it to be more like the following if it is an array of strings: '{"roles":["xxx-…","xxx-…","xxx-…","xxx-..."]}’</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">If your IdP is logging on TRACE, you should be able to see if the transcoder is decoding the ‘roles’ claim e.g. a logging line something like:</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">TRACE [net.shibboleth.oidc.attribute.transcoding.AbstractOIDCAttributeTranscoder:207] - Beginning to decode claim ‘roles'</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">Can you see that?</span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;"><br></span></pre>
<pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="text-wrap-mode: wrap;">Phil<br></span><blockquote type="cite" style="text-wrap-mode: wrap;"><pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">

Any idae?


Thanks


Chris</pre></blockquote><span style="text-wrap-mode: wrap;">
</span></pre>
<br class="Apple-interchange-newline">
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice</p>
</font></font>
</body>
</html>