Shibboleth与AzureAD集成：转码规则无法获取透传属性

我已按文档完成Shibboleth 4.3与AzureAD的集成，将其作为代理IdP使用，重定向和响应均正常，但属性解析器/声明规则无法获取Azure返回的属性。从日志中能看到系统遍历了azureClaims.xml/解析器中映射的各个属性/声明，但无法将其透传至我的服务提供商，最终系统报错提示无法完成映射。我已多次检查映射配置，但仍未找到问题，求问是否有人遇到过类似问题，是否有遗漏的配置点？

相关日志条目 #

2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.microsoft.com/identity/claims/tenantid', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.microsoft.com/identity/claims/objectidentifier', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.microsoft.com/identity/claims/displayname', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.microsoft.com/identity/claims/identityprovider', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.microsoft.com/claims/authnmethodsreferences', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:511] - Profile Action ValidateSAMLAuthentication: No transcoding rule for Attribute (Name 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name', NameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified')
2023-01-30 23:12:10,735 - 10.254.252.105 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:482] - Profile Action ValidateSAMLAuthentication: Incoming SAML Attributes mapped to attribute IDs: []
2023-01-30 23:12:10,735 - 10.254.252.105 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:326] - Profile Action ValidateSAMLAuthentication: SAML authentication succeeded for '<my_azure_email>'
2023-01-30 23:12:10,735 - 10.254.252.105 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:361] - Profile Action ValidateSAMLAuthentication: Added translated AuthnContext Principals: [urn:oasis:names:tc:SAML:2.0:ac:classes:Password]
2023-01-30 23:12:10,735 - 10.254.252.105 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ValidateSAMLAuthentication:300] - Profile Action ValidateSAMLAuthentication: Resetting authentication time to proxied value: 2023-01-31T00:58:45.582Z
2023-01-30 23:12:10,782 - 10.254.252.105 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:75] - Profile Action PopulateSubjectCanonicalizationContext: Installing 3 canonicalization flows into SubjectCanonicalizationContext
2023-01-30 23:12:10,782 - 10.254.252.105 - INFO [Shibboleth-Audit.SSO:338] - 2023-01-31T04:12:10.782744400Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_2a73955fd5a49d06c9567eb52a05cd99|https://sts.windows.net/f42c8e55-f934-4f2c-b0ce-a1e403fd1b9d/|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://<idp_url>/idp|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_60d95c36-51de-45d7-bbcd-25539e822daf||urn:oasis:names:tc:SAML:2.0:ac:classes:Password||<my_azure_email>|_75101b2a-a777-485e-ab76-c816ff9f4301|
2023-01-30 23:12:10,813 - 10.254.252.105 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/attribute for applicability...
2023-01-30 23:12:10,813 - 10.254.252.105 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/attribute
2023-01-30 23:12:10,860 - 10.254.252.105 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:251] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution with label: c14n/attribute
2023-01-30 23:12:10,860 - 10.254.252.105 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:469] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'passthroughAttributes'
2023-01-30 23:12:10,860 - 10.254.252.105 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:478] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'passthroughAttributes'
2023-01-30 23:12:10,860 - 10.254.252.105 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:424] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector passthroughAttributes

内容的提问来源于stack exchange，提问作者NickH48226