<div dir="ltr"><div><div class="gmail_default" style="font-family:monospace">I think something similar happened to me. It had something to do with the attribute encoder... Not sure if you're running into the same issue, but you might want to check. Basically we had our shib over years and years and still using somewhat old/modded XML files. From my comments...</div><div class="gmail_default" style="font-family:monospace"><br></div><div class="gmail_default" style="font-family:monospace">Warning in order to make this work, you have to add an<br> attribute encoder to the "original" SAML attribute. When they created<br> it, they overrode it as SAML only. This is true of all attributes<br> with the AttributeEncoder tag for SAML. Perhaps a few below too, in<br> the profile scope. (See conf/attribute-resolver.xml id="email"</div><div class="gmail_default" style="font-family:monospace">...</div><div class="gmail_default" style="font-family:monospace"> <AttributeDefinition id="email" xsi:type="Simple"><br> <InputDataConnector ref="udldap" attributeNames="mail"/><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" /><br> <!-- See Note in oidc-attribute-filter.xml --><br><b> <AttributeEncoder xsi:type="oidc:OIDCString" name="email" /></b></div><br clear="all"></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><font face="monospace">Thanks,</font><div><font face="monospace">Emilio</font></div><div><font face="monospace"><br></font></div></div></div></div><br></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Tue, Sep 2, 2025 at 2:47 PM Bryan K. Walton via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">We have a working Shibboleth IdP that has been doing SAML for many<br>
years. We are trying to add OIDC/Oauth to this server. I've followed<br>
the instructions found here:<br>
<br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1376878976/OIDC+OP</a><br>
<br>
I've setup a temporary OIDC application on my workstation that uses<br>
mod_auth_openidc.<br>
<br>
Authentication appears to be working to the mod_auth_openidc protected<br>
web page. Our Shibboleth IdP is releasing a pairwise version of the<br>
required subject claim and I see that in my application's Apache logs<br>
as the remote user.<br>
<br>
However, I'm trying and failing to get my remote user changed to<br>
email. I've set my mod_auth_openidc config to use email for<br>
"OIDCRemoteUserClaim". I also have OIDCScope set to:<br>
"openid email profile".<br>
<br>
Now, when I login to the proteced application, I<br>
get:<br>
<br>
[Tue Sep 02 13:38:10.399527 2025] [auth_openidc:warn] [pid 1870717:tid<br>
1870717] [client <a href="http://10.1.88.51:39498" rel="noreferrer" target="_blank">10.1.88.51:39498</a>] oidc_get_remote_user: JSON object did<br>
not contain a "email" string<br>
[Tue Sep 02 13:38:10.399634 2025]<br>
[auth_openidc:error] [pid 1870717:tid 1870717] [client <a href="http://10.1.88.51:39498" rel="noreferrer" target="_blank">10.1.88.51:39498</a>]<br>
oidc_response_set_request_user: OIDCRemoteUserClaim is set to "email",<br>
but could not set the remote user based on the requested claim "email"<br>
and the available claims for the user<br>
[Tue Sep 02 13:38:10.399662 2025] [auth_openidc:error] [pid 1870717:tid <br>
1870717] [client <a href="http://10.1.88.51:39498" rel="noreferrer" target="_blank">10.1.88.51:39498</a>] oidc_response_process: remote user <br>
could not be set<br>
<br>
In my IdP's attribute-filter.xml, I have the following:<br>
<br>
<AttributeFilterPolicy id="OPENID_SCOPE_EMAIL"><br>
<PolicyRequirementRule xsi:type="oidc:OIDCScope" value="email" /><br>
<AttributeRule attributeID="mail"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule><br>
<AttributeRule attributeID="email_verified"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
One more thing that I will add. We have no difficulty release the email<br>
attribute to SAML applications.<br>
<br>
If anybody can point me to where I might have gone astray, I would<br>
appreciate it.<br>
<br>
Thanks,<br>
Bryan<br>
<br>
-- <br>
Bryan K. Walton 319-337-3877 <br>
Senior Linux Systems Administrator Leepfrog Technologies, Inc <br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>