IDP Failure

[Ogunleye, Philip]

Hi All,

 

Forgive my naivety but I did not know that I couldn't use a transientID
to send the username.  I am working off of an example provided by the
company who will be the identity provider going forward.  I have setup
all areas to use transient ids.  I simply want the value sent over to be
verified in the directory service and reported back successfully.

 

<?xml version="1.0" encoding="UTF-8"?><saml2p:AuthnRequest
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceIndex="0"
AssertionConsumerServiceURL="http://readw7PhilipO:9292/TestServlet/TestP
ost" Destination="https://readw7philipo:8443/idp/profile/SAML2/POST/SSO"
ForceAuthn="true" ID="74A1AF7DD0F"
IssueInstant="2013-01-15T15:26:10.116Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
ProviderName="string" Version="2.0"><saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://snaponglobal
.com/SAML</saml2:Issuer><saml2:Subject
<https://snaponglobal.com/SAML%3c/saml2:Issuer%3e%3csaml2:Subject>
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualified
Name">hk3585</saml2:NameID></saml2:Subject></saml2p:AuthnRequest>

 

 

<?xml version="1.0" encoding="UTF-8"?><saml2p:Response
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="http://readw7PhilipO:9292/TestServlet/TestPost"
ID="_fd0853cc4ff8f944c7b990815d84e8a1" InResponseTo="74A1AF7DD0F"
IssueInstant="2013-01-15T15:26:18.743Z" Version="2.0"><saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://readw7
PhilipO.snaponglobal.com/idp/shibboleth</saml2:Issuer><saml2p:Status><sa
ml2p:StatusCode
<https://readw7PhilipO.snaponglobal.com/idp/shibboleth%3c/saml2:Issuer%3
e%3csaml2p:Status%3e%3csaml2p:StatusCode>
Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal"/></saml2p:St
atusCode><saml2p:StatusMessage>Error resolving
principal</saml2p:StatusMessage></saml2p:Status></saml2p:Response>

 

However I am getting a failure response below.  I haven't seen any
indication on the shibboleth wiki to tell me otherwise so assumed it was
ok to send in this format.  I have amended the service provider to send
the request as a WindowDomainQualifiedName value.  However the same
response is sent back.  The name ID format in both the IDP and SP
metadata has been modified to go in the same format too.  I will also
amend the attribute-resolver.xml and the attribute-filter.xml likewise.

 

Please let me know what else should be changed.

 

Thanks.

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20130115/d2387508/attachment.html