Differences

This shows you the differences between two versions of the page.

--- docpublic:systemes:shibboleth:idpproxy [2021/06/09 14:55]
adminjp [Subject Principal]
+++ docpublic:systemes:shibboleth:idpproxy [2021/06/09 15:07] (current)
adminjp [pass-though attributes]
@@ Line 170: / Line 170: @@
 </code>
+===== pass-though attributes =====
+ThenI encontered an issue regarding pass-through attributes, only the subject Princicpal was transmetted to the SP :
+<code>
+-02-04 09:13:52,451 -- DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:118] - Profile Action FinalizeAuthentication: Canonical principal name was established as 'jehan.procaccia@imtbs-tsp.eu'
+-02-04 09:13:52,500 - 157.159.52.132 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:139] - Attribute Definition 'uid': produced an attribute with the following values [StringAttributeValue{value=jehan.procaccia@imtbs-tsp.eu}]
+</code>
+But the other ones resolved before => eduPersonPrincipalName, eduPersonScopedAffiliation, uid ;
+<code>
+-02-04 09:13:52,301 -- DEBUG [net.shibboleth.idp.attribute.filter.AttributeFilterPolicy:153] - Attribute Filter Policy 'saml-proxy-pass-through'  Applying attribute filter policy to current set of attributes: [mail, eduPersonPrincipalName, eduPersonScopedAffiliation, uid]
+</code>
+got lost in the process .
+The solution was in the Doc :  https://wiki.shibboleth.net/confluence/display/IDP4/SubjectDataConnector
+A new  dataConnector for the IPD-proxy (attribute-resolver.xml) was needed :
+<code>
+<DataConnector id="passthroughAttributes" xsi:type="Subject" exportAttributes="mail givenName sn eduPersonAffiliation eduPersonPrincipalName" />
+</code>
+there is no need to add to that Dataconnector a derivated AttributeDefinition , which I've done in the 1st place but then commented and it still worked fine
+:!: not needed :!:
+<code>
+<!-- <AttributeDefinition xsi:type="Simple" id="sn">
+    <InputDataConnector ref="passthroughAttributes" attributeNames="sn" />
+</AttributeDefinition> -->
+</code>
+===== Raw shibboleth-users ML threads =====
+All this was possible thanks to the Mailing list shibboleth-users , cf this thread for details
+  * https://marc.info/?t=161193758600001&r=1&w=2

docpublic/systemes/shibboleth/idpproxy.1623250556.txt.gz · Last modified: 2021/06/09 14:55 by adminjp

Show page Old revisions

[unknown link type]Back to top