[ https://issues.shibboleth.net/jira/browse/SIDP-509?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chad La Joie closed SIDP-509.
-----------------------------
Resolution: Invalid
You have two principal connectors listed for the same format. That's not allowed. If you really do have a case where multiple SPs are using different name identifiers and calling them the same thing you can list which SPs a given principal connector applies to. The real solution though is not to have two different things and call them the same thing.
> Attribute Query does not work with CryptoTransientId and SAML 2.
> ----------------------------------------------------------------
>
> Key: SIDP-509
> URL: https://issues.shibboleth.net/jira/browse/SIDP-509
> Project: Shibboleth IdP 2 - Java
> Issue Type: Bug
> Components: Attribute Resolution
> Affects Versions: 2.3.2
> Environment: Linux (RHEL 6 x86_64), httpd 2.2.15, Tomcat 6.0.24, JDK 1.6.0_26 + Unlimited Strength Crypto Policy
> Reporter: Tom Poage
> Assignee: Chad La Joie
> Priority: Minor
>
> Exercising IdP 2.3.2 against SP 2.4.3, with and without CryptoTransientId, with and without includeAttributeStatement.
> SAML 1 Attribute Query works with the regular TransientId.
> SAML 2 Attribute Query works with the regular TransientId.
> SAML 1 Attribute Query works with CryptoTransientId.
> SAML 2 Attribute Query does *not* work with CryptoTransientId (_i.e._ {{includeAttributeStatement="false"}})
> Session created, but the IdP doesn't recognize the principal associated with the crypto transient ID in the call back.
> {code:xml}
> 12:06:15.073 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:549] - Error resolving principal name for SAML request '_f1cdf3f9eb538d929a5b7f16a7c35844' from relying party 'https://XXXXXX.ucdavis.edu/shibboleth'. Cause: No information associated with transient identifier: BVHR4WWQI4VC6CNDXN6PV6UBCFBBS265PTQ4PQ7IFARPK6DB53LEST3N7ILQYYIZKSVXSIJ4SP45X5HOQ2EOWF7C2XUQM5XGZ7HITPT26JPR65N2RBLSKQGQKTL2MZ3NKZ5DWXRDEGZV52XY3TQ7NOERZWUYAFZVLLOSVTNAOBFWVZ4EBEDAR4HH35J4T2RS5UMVFYFVMRICZQRDO5UNTPUALTCLN2NSZS2DSWS3I5NRTMKCODUPTNK2GZZACN5M
> 12:06:15.083 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:48] - Beginning encode message to outbound transport of type: org.opensaml.ws.transport.http.HttpServletResponseAdapter
> 12:06:15.084 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPSOAP11Encoder:132] - Building SOAP message
> 12:06:15.084 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPSOAP11Encoder:141] - Adding SAML message to the SOAP message's body
> 12:06:15.084 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:96] - Marshalling message
> 12:06:15.095 - DEBUG [PROTOCOL_MESSAGE:73] -
> <?xml version=3D"1.0" encoding=3D"UTF-8"?><soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/">
> <soap11:Body>
> <saml2p:Response xmlns:saml2p=3D"urn:oasis:names:tc:SAML:2.0:protocol" ID=3D"_e91c7e6051b575866ffb16106f97b922" InResponseTo=3D"_f1cdf3f9eb538d929a5b7f16a7c35844" IssueInstant="2011-07-28T19:06:15.081Z" Version="2.0">
> <saml2:Issuer xmlns:saml2=3D"urn:oasis:names:tc:SAML:2.0:assertion" Format=3D"urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:ucdavis.edu</saml2:Issuer>
> <saml2p:Status>
> <saml2p:StatusCode Value=3D"urn:oasis:names:tc:SAML:2.0:status:Responder">
> <saml2p:StatusCode Value=3D"urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal"/>
> </saml2p:StatusCode>
> <saml2p:StatusMessage>Error resolving principal</saml2p:StatusMessage>
> </saml2p:Status>
> </saml2p:Response>
> </soap11:Body>
> </soap11:Envelope>
> {code}
> Principal connectors seem nominal:
> {code:xml}
> <resolver:PrincipalConnector xsi:type="pc:CryptoTransient" id="shibCrypto" dataSealerRef="shibboleth.TransientIDDataSealer" nameIDFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
> <resolver:PrincipalConnector xsi:type="pc:CryptoTransient" id="saml2Crypto" dataSealerRef="shibboleth.TransientIDDataSealer" nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
> {code}
> Would think it affects 2.3.3, as well, but did not re-verify with this release.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira