encrypted principle name

[Mackay, Rob]

My product has supported Office 365 authentication via Shibboleth SAML2 integration for several years but a recent regression testing exposed that this feature is not working.

The configuration is the same as in previous releases but I did notice the principle being returned

filter = (uid=rdeWOox+N8Gc626Gq/ZXarrUzjM=)

My question starts with this userid being returned from Microsoft - should the userid be encrypted and if the userid is encrypted and is failing LDAP lookup because of that would it translate into no viable attribute being releasable ?

in the filter template inside attribute-resolver.xml
<dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
---------------------------------------------

09:18:18.656 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:491] - No attribute of principal 'rdeWOox+N8Gc626Gq/ZXarrUzjM=' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' for relying party 'urn:federation:MicrosoftOnline'

with a response of
<saml2p:Status>
      <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
         <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
      </saml2p:StatusCode>
      <saml2p:StatusMessage>Required NameID format not supported</saml2p:StatusMessage>
   </saml2p:Status>

fragment from attribute-resolver.xml
<!-- UserPrincipalName for Windows Azure AD User ID -->
<resolver:AttributeDefinition id="UserId" xsi:type="ad:Simple" sourceAttributeID="mail">
      <resolver:Dependency ref="myLDAP" />
      <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="IDPEmail" friendlyName="UserId" />
</resolver:AttributeDefinition>


Rob MacKay | Architect, Luminis Platform | ellucian(r)  | O:+1.801.257.4247 | M:+1.801.787.0504 | www.ellucian.com<http://www.ellucian.com>

CONFIDENTIALITY: This email (including any attachments) may contain confidential, proprietary and privileged information, and unauthorized disclosure or use is prohibited. If you received this email in error, please notify the sender and delete this email from your system. Thank you.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160502/239d81a9/attachment.html>