users mail list not accessible to me

Wed Dec 13 06:46:10 EST 2017

hello,

sorry to interupt in dev list  but it's been 3 days that I try to send a 
mail to users at shibboleth.net mailing list , but mails never appears , it 
could have been a filter in my local mailer agent but it's not even in 
the mailing list archive either : https://marc.info/?l=shibboleth-users .

my smtp does show the mails beeing sent

[root at smtp4 log]# grep shibboleth maillog
Dec 11 16:29:21 smtp4 postfix/smtp[12939]: D6886C0610D8: 
*to=<users at shibboleth.net>, *relay=shibboleth.net[108.163.128.190]:25, 
delay=1.1, delays=0/0/0.67/0.4, dsn=2.0.0, *status=sent* (250 2.0.0 Ok: 
queued as 9CD531818BECF0)
Dec 12 20:58:47 smtp4 postfix/smtp[26670]: 4290DC06185C: 
*to=<users at shibboleth.net>*, relay=shibboleth.net[108.163.128.190]:25, 
delay=0.87, delays=0/0/0.48/0.39, dsn=2.0.0, *status=sent *(250 2.0.0 
Ok: queued as C792D18173A5E0)
Dec 13 08:32:26 smtp4 postfix/smtp[32406]: CFDD0C0610E4: 
to=<users-subscribe at shibboleth.net>, 
relay=shibboleth.net[108.163.128.190]:25, delay=2.3, 
delays=0/1.3/0.76/0.25, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 
0FBAB1816471DB)
Dec 13 08:57:47 smtp4 postfix/smtp[32606]: 70DAFC061B62: 
*to=<users at shibboleth.net>, *relay=shibboleth.net[108.163.128.190]:25, 
delay=1.2, delays=0/0/0.72/0.43, dsn=2.0.0, *status=sent *(250 2.0.0 Ok: 
queued as 49434181717C29)

notice that I also subscribe with a second email address (the one that 
sends that mail, previous were in jehan.procaccia at it-sudparis.eu) , but 
still no success.

is there a technical issue ? am I black listed ?

anyway, here is the mail I tried to send since dec 11 :

From: Jehan Procaccia <jehan.procaccia at tem-tsp.eu>
Subject: nameID and persitentID for specific SP
To: users at shibboleth.net
Message-ID: <61ddd855-5723-e54d-8577-74e3d53e4bcc at tem-tsp.eu>
Date: Tue, 12 Dec 2017 20:58:42 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
  Thunderbird/52.4.0
MIME-Version: 1.0
Content-Type: multipart/alternative;
  boundary="------------7DAFA63DE8F63B1B6A2E692B"
Content-Language: fr-xx-classique+reforme1990

This is a multi-part message in MIME format.
--------------7DAFA63DE8F63B1B6A2E692B
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable

Hello

Some SP and vendors wants a particular nameID to authorize acces to=20
their services, ei eduPersonTargetedID as a persistentID

I want to be able to send this particular nameID only to specific SPs

but still take advantage of a default /nameid-format://transient/ for=20
the other majority of SPs , so that I am not exposed to a global failure =

if a the eduPersonTargeted storeID DB fails

I figured out that doc related to that purpose=20
https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerati=
onConfiguration

so I uncommented in saml-nameid.properties

# For computed IDs, set a source attribute and a secret salt:
idp.persistentId.sourceAttribute =3D mail
idp.persistentId.useUnfilteredAttributes =3D true
# Do *NOT* share the salt with other people, it's like divulging your=20
private key.
idp.persistentId.algorithm =3D SHA
idp.persistentId.salt =3D secret

and uncommented bold section below in saml-nameid.xml expecting to get a =

Persitent nameID format for the targeted SP=20
"https://services.renater.fr/shibboleth"

<!-- SAML 2 NameID Generation -->
  =C2=A0=C2=A0=C2=A0 <util:list id=3D"shibboleth.SAML2NameIDGenerators">

  =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <ref bean=3D"shibboleth.SAML2=
TransientGenerator" />

  =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <!-- Uncommenting this bean r=
equires configuration in=20
saml-nameid.properties. -->
*<ref bean=3D"shibboleth.SAML2PersistentGenerator" />**
**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <bean parent=3D"shibboleth.S=
AML2AttributeSourcedGenerator"**
**p:format=3D"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 p:at=
tributeSourceIds=3D"#{ {'mail'} }" >**
**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 <property name=3D"activationCondition">**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 <bean par=
ent=3D"shibboleth.Conditions.RelyingPartyId"=20
c:candidate=3D"https://services.renater.fr/shibboleth" />*

*=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 </bean>*
  =C2=A0=C2=A0=C2=A0 </property>
  =C2=A0=C2=A0=C2=A0 </util:list>

Unfortunaltly is doesn't seem to work according to IDP's process log:

The targeted condition/activate SP is correctly match :

2017-12-11 16:10:57,224 - INFO [Shibboleth-Consent-Audit.SSO:241] -=20
20171211T151057Z|*https://services.renater.fr/shibboleth*|AttributeReleas=
eConsent|procaccia|eduPersonPrincipalName,mail,uid||true,true,true

but regarding nameID there is a pb

2017-12-11 16:10:57,295 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile =

Action AddNameIDToSubjects: Attempting to add NameID to outgoing=20
Assertion Subjects
2017-12-11 16:10:57,295 - DEBUG=20
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218=
]=20
- Policy checking disabled for NameIDPolicy with Format=20
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2017-12-11 16:10:57,296 - DEBUG=20
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrat=
egy:82]=20
- Metadata specifies the following formats: []
2017-12-11 16:10:57,296 - DEBUG=20
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrateg=
y:100]=20
- Configuration specifies the following formats: []
2017-12-11 16:10:57,296 - DEBUG=20
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrateg=
y:110]=20
- No formats specified in configuration or in metadata, returning default=

2017-12-11 16:10:57,297 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile =

Action AddNameIDToSubjects: Candidate NameID formats:=20
[urn:oasis:names:tc:SAML:2.0:nameid-format:transient]
2017-12-11 16:10:57,297 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile =

Action *AddNameIDToSubjects: Trying to generate NameID with Format=20
urn:oasis:names:tc:SAML:2.0:nameid-format:transient**
**2017-12-11 16:10:57,298 - ERROR=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile =

Action AddNameIDToSubjects: Error while generating NameID*
org.opensaml.saml.common.SAMLException: Invalid=20
NameIdentifierGenerationService configuration
  =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 at=20
net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(Pr=
oxySAML2NameIDGenerator.java:62)
2017-12-11 16:10:57,299 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile =

Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty
2017-12-11 16:10:57,303 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:26=
7]=20
- Profile Action AddSubjectConfirmationToSubjects: Attempting to add=20
SubjectConfirmation to assertions in outgoing Response

1st it tries to send a transient namedID , although I expected a=20
computed on the fly persitenID based on mail attribute regarding my=20
config /bean=3D"shibboleth.SAML2PersistentGenerator/**above*
*

2nd it fails =3D> Unable to generate a NameID, leaving empty

although finally there seems to be a transient namedID though !?

2017-12-11 16:10:57,563 - INFO [Shibboleth-Audit.SSO:241] -=20
20171211T151057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_411a=
a04d9cff0e56166ea4ac8e2725a4|https://services.renater.fr/shibboleth|http:=
//shibboleth.net/ns/profiles/saml2/sso/browser|https://idp3.tem-tsp.eu/id=
p/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f6c77f00f87d=
fbee3b92b4581800aae4|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:Pas=
swordProtectedTransport

|uid,mail,eduPersonPrincipalName||*_4c7ace16b2aa2056cec31abf2591e650*|

Where did I went wrong ?

regards .

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20171213/cd8021f2/attachment.html>