I have successfully configured Apache 2 with libapache2-mod-shib2 on Debian to accept SAML assertions from ADFS (v2.0 from my understanding)

In ADFS, the only way I found out to transfer user identity was:

  • Add Send LDAP claim rule to get ActiveDirectory "SAM-Account-Name" as "PPID"
  • Add Pass through claim rule for "PPID"
  • Add Transform rule to convert "PPID" into "Name ID" with format "Persist Identifier"

For unknown reason, transferring "SAM-Account-Name" directly as "Name ID" fails to transform as "Persistent Identifier". (I agree I did not dig into custom rule language)

Shibboleth receives attribute as SAML Assertion - here is excerpt from decrypted payload:

  <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">mylogin
  <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
    <SubjectConfirmationData InResponseTo="_" NotOnOrAfter="2018-06-20T09:16:59.446Z" Recipient="https://myhost.domain/Shibboleth.sso/SAML2/POST"/>
<Conditions NotBefore="2018-06-20T09:11:59.446Z" NotOnOrAfter="2018-06-20T10:11:59.446Z">
  <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier">

As default mapper reformats attribute value, I had to replace original formatter="$NameQualifier!$SPNameQualifier!$Name" in attribute-map.xml as:

<!-- Fourth, the SAML 2.0 NameID Format: -->
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
    <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$Name" defaultQualifiers="true"/>

Current situation is satisfying, Apache 2 receives original user login name as REMOTE_USER.

After multiple trials, I failed to apply same logic to add "Email Address" as additional attribute to SAML Assertion as "AttributeStatement". What is the simplest way to achieve it?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.