saml:AuthenticatingAuthority and Assertion Extraction

[Andy Bennett]

Hi,

I'm running a 2.4.3+dfsg-2~bpo60+1 Shibboleth Service Provider and I'm
interested in getting at saml:AuthenticatingAuthority. This appears to
be an "Assertion" rather than an "Attribute" and I'm having trouble
working out how to extract it.

I've got exportAssertion="true" set on <Host ...> in <RequestMap> in
<RequestMapper ...> in shibboleth2.xml and I'm seeing
Shib-Identity-Provider CGI variables but I've *never* seen any
Shib-Assertion-Count or Shib-Assertion-NN CGI variables.


https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor#NativeSPAttributeExtractor-XMLAttributeExtractor

seems to claim that an XML AttributeExtractor can extract things from
<saml2:Assertion> but I'm not sure what syntax to put in
attribute-map.xml to make this work.


https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor#NativeSPAttributeExtractor-AssertionAttributeExtractor%28Version2.5andAbove%29

seems to imply that I might not be able to do this without upgrading to
the 2.5 SP software.

A bit of Googling suggests there were some commits over 2 years ago
which added some kind of functionality along these lines but it's not
clear what release they went into.


Can anyone offer any advice about how to do this and how to use
attribute-map.xml to extract assertions.


Many thanks.



Regards,
@ndy

[Cantor, Scott]

Post by Andy Bennett
I've got exportAssertion="true" set on <Host ...> in <RequestMap> in
<RequestMapper ...> in shibboleth2.xml and I'm seeing
Shib-Identity-Provider CGI variables but I've *never* seen any
Shib-Assertion-Count or Shib-Assertion-NN CGI variables.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAssertionExpor
t

You don't have exportLocation or exportACL set, I would imagine.

Post by Andy Bennett
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtr
actor#NativeSPAttributeExtractor-XMLAttributeExtractor
seems to claim that an XML AttributeExtractor can extract things from
<saml2:Assertion> but I'm not sure what syntax to put in
attribute-map.xml to make this work.

It handles Attributes and NameIDs, that's it. If you tell me what text
implies otherwise, I'll adjust it.

Post by Andy Bennett
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtr
actor#NativeSPAttributeExtractor-AssertionAttributeExtractor%28Version2.5a
ndAbove%29
seems to imply that I might not be able to do this without upgrading to
the 2.5 SP software.

Again, please tell me what implies that and I can fix it. The version
indicator is there.

Post by Andy Bennett
A bit of Googling suggests there were some commits over 2 years ago
which added some kind of functionality along these lines but it's not
clear what release they went into.

Assertion AttributeExtractor (Version 2.5 and Above)


-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org

[Andy Bennett]

Hi,

Thanks for the reply!

Post by Cantor, Scott

Post by Andy Bennett
I've got exportAssertion="true" set on <Host ...> in <RequestMap> in
<RequestMapper ...> in shibboleth2.xml and I'm seeing
Shib-Identity-Provider CGI variables but I've *never* seen any
Shib-Assertion-Count or Shib-Assertion-NN CGI variables.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAssertionExpor
t
You don't have exportLocation or exportACL set, I would imagine.

If I enable those will I get given URLs that can be queried to find the
AuthenticatingAuthority Assertion?

Post by Cantor, Scott

Post by Andy Bennett
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtr
actor#NativeSPAttributeExtractor-XMLAttributeExtractor
seems to claim that an XML AttributeExtractor can extract things from
<saml2:Assertion> but I'm not sure what syntax to put in
attribute-map.xml to make this work.

It handles Attributes and NameIDs, that's it. If you tell me what text
implies otherwise, I'll adjust it.

-----
The plugin supports extraction from the following SAML constructs:

<saml:Assertion>
<saml:Attribute>
<saml:NameIdentifier>
<saml2:Assertion>
<saml2:Attribute>
<saml2:NameID>
<saml2:EncryptedAttribute>
-----

Wherein the word "Assertion" appears.

Post by Cantor, Scott

Post by Andy Bennett
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtr
actor#NativeSPAttributeExtractor-AssertionAttributeExtractor%28Version2.5a
ndAbove%29
seems to imply that I might not be able to do this without upgrading to
the 2.5 SP software.

Again, please tell me what implies that and I can fix it. The version
indicator is there.

It says it can be done with the "Assertion AttributeExtractor" and
provides an example but that extractor is only available in 2.5:

-----
Assertion AttributeExtractor (Version 2.5 and Above)
-----

Post by Cantor, Scott

Post by Andy Bennett
A bit of Googling suggests there were some commits over 2 years ago
which added some kind of functionality along these lines but it's not
clear what release they went into.

Assertion AttributeExtractor (Version 2.5 and Above)

Thanks.





Regards,
@ndy

[Cantor, Scott]

Post by Andy Bennett
If I enable those will I get given URLs that can be queried to find the
AuthenticatingAuthority Assertion?

You should.

Post by Andy Bennett
<saml:Assertion>
Wherein the word "Assertion" appears.

Ok. That's referring to the fact that it examines that element for the
constructs it actually knows what to do something with, but I'll fix it.

Post by Andy Bennett
It says it can be done with the "Assertion AttributeExtractor" and

Right. So how does that imply you can do it with 2.4?

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org

[Andy Bennett]

Hi,

Thanks for the clarifications. I think I can understand it now...

Post by Cantor, Scott

Post by Andy Bennett
If I enable those will I get given URLs that can be queried to find the
AuthenticatingAuthority Assertion?

You should.

Post by Andy Bennett
<saml:Assertion>
Wherein the word "Assertion" appears.

Ok. That's referring to the fact that it examines that element for the
constructs it actually knows what to do something with, but I'll fix it.

Post by Andy Bennett
It says it can be done with the "Assertion AttributeExtractor" and

Right. So how does that imply you can do it with 2.4?
-- Scott

Regards,
@ndy