<div dir="ltr"><div>[WARNING: LONGISH post !]</div><div><br></div><div>Hi Peter (et al),</div><div><br></div><div>Apologies in advance, but after thinking about things overnight and after reading and re-reading your message below, I decided that I should go "backwards" a little, and try to get the attributes working as best I can first, which I think is actually what you, and several others have been recommending.</div><div><br></div><div>I also really liked that test setup you provided/described, with the "unexistingTestSP", so I've been using that and modifying mostly the attribute-filter.xml (and possibly the attribute-resolver.xml) to try to get the aacli test to return all of the attributes I want to get in the response.</div><div><br></div><div>So, after adding the attributes that I was missing (the "cn", "sn", and "givenName" ) to the attribute-filter.xml and also to the "exportAttribues=" parameter in the DataConnector in the attribute-resolver.xml, I am now able to run the aacli and get all the attributes we were looking to return, EXCEPT, I cannot seem to get the "mail" attribute that is populated in the LDAP to be returned in the SAML Response :(...</div><div><br></div><div>SIDE note: I am actually a little confused by the name for that attribute in the LDAP server, because the "name" for that attribute is different in 3 different places/contexts:</div><div></div><ul><li>In the LDAP server, in the schema, it shows "emailAddress" as the attribute name. </li><li>However, in the LDAP Server Admin app, it appears as "E-mail", and </li><li>when I do an ldapsearch, the attribute is being returned as an attribute named "mail"!!</li></ul><div><br></div><div>In the Shibboleth logs, when I was running the aacli test, I was seeing the following (in both the idp-warn.log and in the idp-process.log) :</div><div><br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">idp-process.log:2025-04-11 11:19:27,783 - 127.0.0.1 - WARN [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:596] - Attribute Resolver 'ShibbolethAttributeResolver': could not export attibute 'mail' from data connector 'myLDAP' since an attribute of that name already exists.</blockquote><br></div><div>Then, I noticed that in the original attribute-resolver there is this stanza:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <AttributeDefinition id="mail" xsi:type="Template"><br> <InputAttributeDefinition ref="uid" /><br> <Template><br> <![CDATA[<br> ${<a href="mailto:uid%7D@example.org">uid}@example.org</a><br> ]]><br> </Template><br> </AttributeDefinition><br></blockquote><div><br></div><div><br></div><div>so I commented out that stanza in the attribute-resolver.xml, and bounced the IdP, and after commenting that out:</div><div></div><ul><li>I don't get the message about the mail already exists in the log files anymore, BUT</li><li>I am still NOT getting email, or mail, or E-mail in the response when I run the aacli test.</li></ul><div></div><div><br></div><div>Here's the current ldapsearch results for the "<a href="mailto:test1@xxxx.com">test1@xxxx.com</a>" user when I do an ldapsearch on the LDAP (notice that the "mail" attribute is populated):</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"># <a href="mailto:test1@xxxx.com">test1@xxxx.com</a>, People, <a href="http://xxxx.com">xxxx.com</a><br>dn: cn=<a href="mailto:test1@xxxx.com">test1@xxxx.com</a>,ou=People,dc=xxxx,dc=com<br>mail: <a href="mailto:this_is_user_TEST1_AT_xxxx_DOT_COM_emailAddress@xxxx.com">this_is_user_TEST1_AT_xxxx_DOT_COM_emailAddress@xxxx.com</a><br>sn: Foo<br>cn: <a href="mailto:test1@xxxx.com">test1@xxxx.com</a><br>givenName: Jack<br>uid: <a href="mailto:test1@xxxx.com">test1@xxxx.com</a><br>displayName: <a href="mailto:test1@xxxx.com">test1@xxxx.com</a></blockquote><div><br></div><div>and here is the aacli run (again, notice that no mail, E-mail, or emailAddress was returned):</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">/opt/shibboleth-idp/bin/aacli.sh --saml2 -n "<a href="mailto:test1@xxxx.com">test1@xxxx.com</a>" -r <a href="https://saml.example.org">https://saml.example.org</a><br><br><br><?xml version="1.0" encoding="UTF-8"?><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_986b0f40444259bc62dc10294e6fa507" IssueInstant="2025-04-11T17:05:21.217Z" Version="2.0"><br> <saml2:Issuer><a href="https://idp01.xxxx.com/idp/shibboleth">https://idp01.xxxx.com/idp/shibboleth</a></saml2:Issuer><br> <saml2:Subject><br> <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="<a href="https://idp01.xxxx.com/idp/shibboleth">https://idp01.xxxx.com/idp/shibboleth</a>" SPNameQualifier="<a href="https://saml.example.org">https://saml.example.org</a>">AAdzZWNyZXQx+kaioGpDluWCFDQF6aweXaC7k+r5Wg/JFiMyAFasMdG0DV+X5i6FjNQkl8k28kksAh1yiWfB2i/5Y...36+9GYkYBh8ADb9eXYzZ+/5609</saml2:NameID><br> </saml2:Subject><br> <saml2:AttributeStatement><br> <saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml2:AttributeValue>Jack</saml2:AttributeValue><br> </saml2:Attribute><br> <saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml2:AttributeValue>Foo</saml2:AttributeValue><br> </saml2:Attribute><br> <saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml2:AttributeValue>test1@xxxx.com@<a href="http://xxxx.com">xxxx.com</a></saml2:AttributeValue><br> </saml2:Attribute><br> <saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml2:AttributeValue><a href="mailto:test1@xxxx.com">test1@xxxx.com</a></saml2:AttributeValue><br> </saml2:Attribute><br> <saml2:Attribute FriendlyName="cn" Name="urn:oid:2.5.4.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml2:AttributeValue><a href="mailto:test1@xxxx.com">test1@xxxx.com</a></saml2:AttributeValue><br> </saml2:Attribute><br> </saml2:AttributeStatement><br></saml2:Assertion></blockquote><div><br></div><div><br></div><div>Here's the current section of the attribute-filter.xml with the added attributes (I included both "email" and "emailAddress", because I was hoping that one of them might work):</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><!-- JL - ADD FOR PETERS METADATA TEST --><br><AttributeFilterPolicy id="unexistingTestSP"><br> <PolicyRequirementRule xsi:type="Requester" value="<a href="https://saml.example.org">https://saml.example.org</a>" /><br> <AttributeRule attributeID="uid" permitAny="true" /><br> <AttributeRule attributeID="eduPersonPrincipalName" permitAny="true" /><br> <AttributeRule attributeID="schacHomeOrganization" permitAny="true" /><br><!-- JL - ADDED FOR BAN --><br> <AttributeRule attributeID="cn" permitAny="true" /><br> <AttributeRule attributeID="email" permitAny="true" /><br> <AttributeRule attributeID="emailAddress" permitAny="true" /><br> <AttributeRule attributeID="sn" permitAny="true" /><br> <AttributeRule attributeID="givenName" permitAny="true" /><br></AttributeFilterPolicy></blockquote><div><br></div><div><br></div><div>and here's the modified line from the attribute-resolver.xml:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> exportAttributes="mail displayName sn givenName departmentNumber employeeNumber eduPersonEntitlement eduPersonAssurance cn emailAddress"></blockquote><div><br></div><div><br></div><div>So I am wondering if anyone might have any suggestions about why the mail/emailAddress isn't being returned in the SAMLResponse when the aacli command is run?</div><div><br></div><div>Thanks in advance!!</div><div><br></div><div>Jim</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid #d3d4de"><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://s-install.avcdn.net/ipm/preview/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a></td></tr></table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, Apr 11, 2025 at 8:18 AM Peter Schober via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">o haya via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> [2025-04-11 02:29 CEST]:<br>
> After some discussion, we want the NameID format to be emailAddress, and<br>
> for the source to be the "cn" attribute. Also "cn" values will be<br>
> emailAddress format.<br>
<br>
In /opt/shibboleth-idp/conf/saml-nameid.xml within this element:<br>
<util:list id="shibboleth.SAML2NameIDGenerators"><br>
here's what you'd add:<br>
<br>
<bean parent="shibboleth.SAML2AttributeSourcedGenerator" <br>
p:omitQualifiers="true" <br>
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" <br>
p:attributeSourceIds="#{ {'mail'} }" /><br>
<br>
Provided that the IDP has an internal attribute called 'mail' which<br>
holds the subject's email address from whatever data source.<br>
If your LDAP server has the subject's email adresss in the LDAP<br>
attribute "cn" (which I would find highly unusual) then you could<br>
either rename the attribute with your IDP attribute resolver by adding<br>
this to the end of your LDAP DataConnector:<br>
<Column columnName="cn" attributeID="mail" /><br>
of you'd change the above example for the NameID generation to use<br>
'cn' where it currently says 'mail'.<br>
<br>
So first get the data into the IDP, then put it into a NameID.<br>
The final piece is making sure the NameID with the desired Format is<br>
sent to the SP in question. The correct and easiest way to do this is<br>
my amending the SP Metadata (that the IDP has on record) with the<br>
desired NameID Format:<br>
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat><br>
<br>
HTH,<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>