Existing SUNET user assigned to wrong local user

[tbfisher]

While investigation this, I see

select * from stanford_ssp_sunetid;                
+-------+-------+
| sunet | uid   |
+-------+-------+
|       | 12345 |
+-------+-------+
1 row in set (0.01 sec)

The data coming back from the IdP does not in include an uid attribute. We have the the setting stanford_simplesamlphp_auth_unique_id set to the correct key and logins work, but when new users come in they get mapped to the uid 12345 via the table above.

[sherakama]

Thanks for posting this @tbfisher,

Which IDP are you using? According to the release policy, UID should always be available.
https://uit.stanford.edu/service/saml/arp

[tbfisher]

@sherakama we are using https://idp.stanford.edu/

[rsmith11]

When I go to either https://libweb-test.stanford.edu/simplesaml/module.php/core/authenticate.php?as=default-sp or
https://library.stanford.edu/simplesaml/module.php/core/authenticate.php?as=default-sp I see that the uid is being shown. I'll continue to investigate.

[sherakama]

Ah, I see, this looks like SP configuration. The OID URN translations are not there.

The attribute is showing up as urn:mace:dir:attribute-def:uid instead of uid

In your SP make sure your configuration files have the correct attribute maps.

https://gist.github.com/sherakama/581a6a1c8fac72e03ac912fc99fde9d3
https://gist.github.com/sherakama/9cde2f1706bd51156efae08f7765470e
https://gist.github.com/sherakama/f9cff9fa041d24bc70661073468bdc84
https://gist.github.com/sherakama/e6a49d936a49f5ff790a58f0e500227a
https://gist.github.com/sherakama/3aacd5b2168f308063df625b526601f0
https://gist.github.com/sherakama/10612e84aee4af25050f71fadef7dac0

[rsmith11]

Thanks so much for the help. I just used the stock ones from the install, so there shouldn't be any custom modifications to the files. The site was running an old version of PHP, so we had to install SimpeSAMLphp 1.14 instead of the most recent. We recently updated the PHP version on the site, so perhaps upgrading to 1.16 might solve it?

I did modify the shibboleth2.xml file to map the REMOTE_USER to uid:
<ApplicationDefaults entityID="https://libweb-test.stanford.edu/shibboleth" REMOTE_USER="uid"> but that's basically it. I used the instructions from https://tcg.stanford.edu/?p=6 more or less, but installed shibboleth from our puppet manifests that we use on all of our other systems.

[sherakama]

Woot, glad it helped.

We should probably add this documentation to the README.md as it isn't explicitly written down anywhere public from what I can tell.

[rsmith11]

I updated simpleSAMLphp to 1.16.3, but I'm still seeing the same listings in the simpleSaml module. I have the same attribute maps you have listed as well.

[sherakama]

Try adding this little bit to config.php

// Core settings.
$config['authproc.sp'] = array(
  10 => array(
    'class' => 'core:AttributeMap',
    'oid2name',
  ),
  90 => 'core:LanguageAdaptor',
);

[rsmith11]

Made the change to the simplesamlphp config file.

        /*
        10 => array(
            'class' => 'core:AttributeMap', 'oid2name'
        ),
        */

        /*
         * Generate the 'group' attribute populated from other variables, including eduPersonAffiliation.
         60 => array(
            'class' => 'core:GenerateGroups', 'eduPersonAffiliation'
        ),
        */
        /*
         * All users will be members of 'users' and 'members'
        61 => array(
            'class' => 'core:AttributeAdd', 'groups' => array('users', 'members')
        ),
        */

        // Adopts language from attribute to use in UI
        90 => 'core:LanguageAdaptor',

    ),

Here's what the attributes show now:

[rsmith11]

As a test, I removed the drupal apache configs and just put a simple config to load Shib on the root URL. I then edited the shibboleth2.xml to show the Session attributes. I was able to see that Shibboleth was returning the correct uid information.