Simplesamlphp Auth Role Assignment

Question

I've set up my Drupal installation as a Service Provider using Simplesamlphp and the Drupal Module Simplesamlphp Authentication (https://www.drupal.org/project/simplesamlphp_auth). I'm successfully able to login using the www.example.com/saml_login method provided, but I haven't been able to setup the automatic role assignments.

From this page: https://www.drupal.org/node/1931394

I've attempted comment #3 but was unable to get it to use the friendly name. Here is what is being sent to me from my IDP:

<saml2:AttributeStatement>
         <saml2:Attribute FriendlyName="uid"
                          Name="urn:oid:0.9.2342.19200300.100.1.1"
                          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                          >
             <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                   xsi:type="xs:string"
                                   >landy</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="eduPersonAffiliation"
                          Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
                          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                          >
             <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                   xsi:type="xs:string"
                                   >member</saml2:AttributeValue>
             <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                   xsi:type="xs:string"
                                   >staff</saml2:AttributeValue>
             <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                   xsi:type="xs:string"
                                   >employee</saml2:AttributeValue>
         </saml2:Attribute>
         <saml2:Attribute FriendlyName="eduPersonPrincipalName"
                          Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
                          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                          >
             <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                   xsi:type="xs:string"
                                   >[email protected]</saml2:AttributeValue>
         </saml2:Attribute>
     </saml2:AttributeStatement>

But I'm unable to get it to automatically populate the role. As an example, I've tried this: 3:uid,=,landy

It's never assigned him to RoleID 3. I've been able to do this from the Rules module, but I'd like to be able to use it in this module if possible because the eventual plan is to use those Affiliation attributes as well which Rules cannot use. Thanks for any help!

Answer 1

I've figured out the issue.

From here: https://simplesamlphp.org/docs/stable/simplesamlphp-authproc

I had to rename the attributes to friendly names so I could use them in the assignment feature of the module. The previous URL attempted to do that, but it wasn't quite as easy as the one line. I had to add each URN to change to the friendly name that I wanted.