<div dir="ltr"><div dir="ltr">On Fri, Jul 11, 2025 at 10:39 PM IAM David Bantz via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:</div><div class="gmail_quote gmail_quote_container"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I did not look in great detail, but I do not see an attribute-filter rule (release policy) for <a href="http://sp.techi.wan:8080/login/saml2/sso/techcorp" style="font-family:monospace" target="_blank">http://sp.techi.wan:8080/login/saml2/sso/techcorp</a><br><font face="monospace"><br>Look at the sample in the file you copied:<br></font><span style="font-family:monospace"> <AttributeFilterPolicy id="example1"></span><br style="font-family:monospace"><span style="font-family:monospace">        <PolicyRequirementRule xsi:type="Requester" value="</span><a href="https://sp.example.org/" style="font-family:monospace" target="_blank">https://sp.example.org</a><span style="font-family:monospace">" /></span><br style="font-family:monospace"><br style="font-family:monospace"><span style="font-family:monospace">        <AttributeRule attributeID="uid" permitAny="true" /></span><br style="font-family:monospace"><span style="font-family:monospace">    </AttributeFilterPolicy></span><font face="monospace"></font><div><span style="font-family:monospace"><br>That releases "uid" to </span><a href="https://sp.example.org/" style="font-family:monospace" target="_blank">https://sp.example.org</a><br><br>You can build something parallel.  Yes there are lots of more clever versions of attribute policy rules, but you might try that bottom rung level first.</div><div><br></div><div>Of course, you should also turn up the logging level for idp-process.log which can tell you in painful detail of every step along the way.</div></div></blockquote><div><br></div><div>That's just one of the examples from the default config that I would think should be ignored.<br><br>You can see sAMAccountName is released at the top of attribute-filter.xml.<br></div><div><br></div><div>I have removed all of the examples so that attribute-filter.xml is just:<br><span style="font-family:monospace"><br><?xml version="1.0" encoding="UTF-8"?><br><AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"<br>        xmlns="urn:mace:shibboleth:2.0:afp"<br>        xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br>        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp <a href="http://shibboleth.net/schema/idp/shibboleth-afp.xsd">http://shibboleth.net/schema/idp/shibboleth-afp.xsd</a>"><br><br>    <AttributeFilterPolicy id="alwaysRelease"><br>        <PolicyRequirementRule xsi:type="ANY" /><br>        <AttributeRule attributeID="sAMAccountName" permitAny="true" /><br>    </AttributeFilterPolicy><br><br></AttributeFilterPolicyGroup></span><br><br>I removed default-rules.xml from services.xml and commented out the one bean in attribute-registry.xml since there are no applicable files in attributes/custom.<br><br>So I think this should simplify things.<br><br>I increased logging in <span style="font-family:monospace">conf/idp.properties</span>:<br><br>idp.loglevel.root<span style="font-family:monospace">: DEBUG</span><br><br>Then I did:<br><br><span style="font-family:monospace">$ bin/build.sh</span><br><br>started a capture, started Jetty, authenticated.<br>I see the KRB5 auth followed immediately by a successful LDAP query.<br>However, there is nothing in the logs about attributes or releasing anything (other than PropertyDrivenModule loading files like attribute-filter.xml):<br><span style="font-family:monospace"><br>INFO [net.shibboleth.idp.authn.impl.KerberosCredentialValidator:201] - Credential Validator krb5: Login by 'dev@TECH.CORP' succeeded<br>INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:201] - Profile Action FinalizeAuthentication: Principal dev@TECH.CORP authenticated<br>DEBUG [org.apache.velocity.loader:442] - ResourceManager: found 084fa3ca-04d0-4151-8dde-dcf4279b7002 with loader org.apache.velocity.runtime.resource.loader.StringResourceLoader<br>DEBUG [org.opensaml.core.xml.util.XMLObjectSupport:273] - Marshalling XMLObject<br>DEBUG [org.opensaml.storage.AbstractMapBackedStorageService:347] - Read failed, key 'AAdzZWNyZXQx/acpQsJuXNINNV8f9BWyHJF6iyevX9UOh+71Obrz2SxjA2AST9vF58CJr/8ZNJXgeAW8RsHrxOj10ZSByU8Ox/Rao0Zpput7HNqlO0USltVi0Ym3aEHVnBr6LsyPyC0zN+1uJtOthOTzvw8vNqw6fGQN9/Z4vit5xEaoGghAkfIaSteOuD+3QJUuskXXtgmR' not found in context '<a href="http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp">http://sp.techi.wan:8080/saml2/service-provider-metadata/techcorp</a>'<br>DEBUG [org.opensaml.storage.impl.client.PopulateClientStorageSaveContext:111] - Profile Action PopulateClientStorageSaveContext: ClientStorageServices requiring save: [shibboleth.ClientSessionStorageService]<br>DEBUG [org.apache.velocity.loader:442] - ResourceManager: found /client-storage/client-storage-write.vm with loader org.apache.velocity.runtime.resource.loader.FileResourceLoader<br>DEBUG [org.apache.velocity.loader:442] - ResourceManager: found client-storage/local-storage-write.js with loader net.shibboleth.shared.spring.velocity.SpringResourceLoader<br>DEBUG [org.apache.velocity.loader:442] - ResourceManager: found client-storage/write.vm with loader net.shibboleth.shared.spring.velocity.SpringResourceLoader<br>DEBUG [org.opensaml.storage.impl.client.LogLocalStorageSaveResults:79] - Profile Action LogLocalStorageSaveResults: Save to local storage for StorageService 'shibboleth.ClientSessionStorageService' succeeded<br>DEBUG [org.opensaml.storage.impl.client.SaveCookieBackedClientStorageServices:108] - Profile Action SaveCookieBackedClientStorageServices: No cookie operations required<br></span></div><div><span style="font-family:monospace">DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message Handler:  Activation condition for handler returned true<br>DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message Handler:  Activation condition for handler returned true<br>DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message Handler:  Activation condition for handler returned true<br>DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message Handler:  Activation condition for handler returned true<br>DEBUG [org.opensaml.messaging.handler.AbstractMessageHandler:146] - Message Handler:  Activation condition for handler returned true<br>DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:103] - Starting to marshall {<a href="http://www.w3.org/2000/09/xmldsig#}Signature">http://www.w3.org/2000/09/xmldsig#}Signature</a><br>DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:111] - Creating XMLSignature object<br>DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:120] - Adding content to XMLSignature.<br>DEBUG [org.opensaml.xmlsec.signature.impl.SignatureMarshaller:125] - Creating Signature DOM element<br>DEBUG [org.opensaml.xmlsec.signature.support.Signer:76] - Using a signer of implemenation: org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl <br>DEBUG [org.opensaml.xmlsec.signature.support.impl.provider.ApacheSantuarioSignerProviderImpl:63] - Computing signature over XMLSignature object<br>DEBUG [org.opensaml.profile.action.impl.EncodeMessage:130] - Profile Action EncodeMessage: Encoding outbound response using message encoder of type org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder for this response<br>DEBUG [org.opensaml.profile.action.impl.EncodeMessage:134] - Profile Action EncodeMessage: Encoder was not initialized, injecting MessageContext and initializing<br>DEBUG [org.opensaml.messaging.encoder.servlet.BaseHttpServletResponseXMLMessageEncoder:50] - Beginning encode of message of type: org.opensaml.saml.saml2.core.impl.ResponseImpl<br>DEBUG [org.opensaml.messaging.encoder.servlet.BaseHttpServletResponseXMLMessageEncoder:86] - Marshalling message<br>DEBUG [org.opensaml.core.xml.util.XMLObjectSupport:273] - Marshalling XMLObject</span><br><br>In <span style="font-family:monospace">conf/ldap.properties</span> I have:<br><br><span style="font-family:monospace">idp.attribute.resolver.LDAP.searchFilter = (userPrincipalName=$resolutionContext.principal)</span><br><br>which I can see being used and gets all properties including sAMAccountName.<br><br>In <span style="font-family:monospace">conf/attribute-resolver.xml</span> I have:<br><br><span style="font-family:monospace">DataConnector ... exportAttributes="sAMAccountName mail displayName sn giv..."></span><br><br>Is there more to the linkage between LDAP and attribute release than this?<br><br>Could <span style="font-family:monospace">excludeResolutionPhases="c14n/attribute"</span> be blocking something?<br><br>Is there something else I can do to just see attribute resolution working at all?<br><br>Where in the source code should I look given the above point-of-failure?<br><br>Mike<br></div><div><br></div></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">Michael B Allen<br>Java AD DS Integration<br><a href="http://www.ioplex.com/" target="_blank">https://www.ioplex.com/</a></div></div></div>