<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>hello, <br>
</p>
<p>sorry to interupt in dev list but it's been 3 days that I try to
send a mail to <a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a> mailing list , but mails never
appears , it could have been a filter in my local mailer agent but
it's not even in the mailing list archive either :
<a class="moz-txt-link-freetext" href="https://marc.info/?l=shibboleth-users">https://marc.info/?l=shibboleth-users</a> .<br>
</p>
<p>my smtp does show the mails beeing sent</p>
<p>[root@smtp4 log]# grep shibboleth maillog<br>
Dec 11 16:29:21 smtp4 postfix/smtp[12939]: D6886C0610D8: <b>to=<a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a>,
</b>relay=shibboleth.net[108.163.128.190]:25, delay=1.1,
delays=0/0/0.67/0.4, dsn=2.0.0, <b>status=sent</b> (250 2.0.0 Ok:
queued as 9CD531818BECF0)<br>
Dec 12 20:58:47 smtp4 postfix/smtp[26670]: 4290DC06185C: <b>to=<a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a></b>,
relay=shibboleth.net[108.163.128.190]:25, delay=0.87,
delays=0/0/0.48/0.39, dsn=2.0.0, <b>status=sent </b>(250 2.0.0
Ok: queued as C792D18173A5E0)<br>
Dec 13 08:32:26 smtp4 postfix/smtp[32406]: CFDD0C0610E4:
to=<a class="moz-txt-link-rfc2396E" href="mailto:users-subscribe@shibboleth.net"><users-subscribe@shibboleth.net></a>,
relay=shibboleth.net[108.163.128.190]:25, delay=2.3,
delays=0/1.3/0.76/0.25, dsn=2.0.0, status=sent (250 2.0.0 Ok:
queued as 0FBAB1816471DB)<br>
Dec 13 08:57:47 smtp4 postfix/smtp[32606]: 70DAFC061B62: <b>to=<a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a>,
</b>relay=shibboleth.net[108.163.128.190]:25, delay=1.2,
delays=0/0/0.72/0.43, dsn=2.0.0, <b>status=sent </b>(250 2.0.0
Ok: queued as 49434181717C29)<br>
</p>
<p>notice that I also subscribe with a second email address (the one
that sends that mail, previous were in
<a class="moz-txt-link-abbreviated" href="mailto:jehan.procaccia@it-sudparis.eu">jehan.procaccia@it-sudparis.eu</a>) , but still no success. <br>
</p>
<p>is there a technical issue ? am I black listed ? <br>
</p>
<p>anyway, here is the mail I tried to send since dec 11 :<br>
</p>
<pre>From: Jehan Procaccia <a class="moz-txt-link-rfc2396E" href="mailto:jehan.procaccia@tem-tsp.eu"><jehan.procaccia@tem-tsp.eu></a>
Subject: nameID and persitentID for specific SP
To: <a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a>
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:61ddd855-5723-e54d-8577-74e3d53e4bcc@tem-tsp.eu"><61ddd855-5723-e54d-8577-74e3d53e4bcc@tem-tsp.eu></a>
Date: Tue, 12 Dec 2017 20:58:42 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Thunderbird/52.4.0
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="------------7DAFA63DE8F63B1B6A2E692B"
Content-Language: fr-xx-classique+reforme1990
This is a multi-part message in MIME format.
--------------7DAFA63DE8F63B1B6A2E692B
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Hello
Some SP and vendors wants a particular nameID to authorize acces to=20
their services, ei eduPersonTargetedID as a persistentID
I want to be able to send this particular nameID only to specific SPs
but still take advantage of a default /nameid-format://transient/ for=20
the other majority of SPs , so that I am not exposed to a global failure =
if a the eduPersonTargeted storeID DB fails
I figured out that doc related to that purpose=20
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerati=">https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerati=</a>
onConfiguration
so I uncommented in saml-nameid.properties
# For computed IDs, set a source attribute and a secret salt:
idp.persistentId.sourceAttribute =3D mail
idp.persistentId.useUnfilteredAttributes =3D true
# Do *NOT* share the salt with other people, it's like divulging your=20
private key.
idp.persistentId.algorithm =3D SHA
idp.persistentId.salt =3D secret
and uncommented bold section below in saml-nameid.xml expecting to get a =
Persitent nameID format for the targeted SP=20
<a class="moz-txt-link-rfc2396E" href="https://services.renater.fr/shibboleth">"https://services.renater.fr/shibboleth"</a>
<!-- SAML 2 NameID Generation -->
=C2=A0=C2=A0=C2=A0 <util:list id=3D"shibboleth.SAML2NameIDGenerators">
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <ref bean=3D"shibboleth.SAML2=
TransientGenerator" />
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <!-- Uncommenting this bean r=
equires configuration in=20
saml-nameid.properties. -->
*<ref bean=3D"shibboleth.SAML2PersistentGenerator" />**
**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <bean parent=3D"shibboleth.S=
AML2AttributeSourcedGenerator"**
**p:format=3D"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 p:at=
tributeSourceIds=3D"#{ {'mail'} }" >**
**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 <property name=3D"activationCondition">**
**=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 <bean par=
ent=3D"shibboleth.Conditions.RelyingPartyId"=20
c:candidate=3D<a class="moz-txt-link-rfc2396E" href="https://services.renater.fr/shibboleth">"https://services.renater.fr/shibboleth"</a> />*
*=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 </bean>*
=C2=A0=C2=A0=C2=A0 </property>
=C2=A0=C2=A0=C2=A0 </util:list>
Unfortunaltly is doesn't seem to work according to IDP's process log:
The targeted condition/activate SP is correctly match :
2017-12-11 16:10:57,224 - INFO [Shibboleth-Consent-Audit.SSO:241] -=20
20171211T151057Z|*<a class="moz-txt-link-freetext" href="https://services.renater.fr/shibboleth*|AttributeReleas=">https://services.renater.fr/shibboleth*|AttributeReleas=</a>
eConsent|procaccia|eduPersonPrincipalName,mail,uid||true,true,true
but regarding nameID there is a pb
2017-12-11 16:10:57,295 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile =
Action AddNameIDToSubjects: Attempting to add NameID to outgoing=20
Assertion Subjects
2017-12-11 16:10:57,295 - DEBUG=20
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218=
]=20
- Policy checking disabled for NameIDPolicy with Format=20
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2017-12-11 16:10:57,296 - DEBUG=20
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrat=
egy:82]=20
- Metadata specifies the following formats: []
2017-12-11 16:10:57,296 - DEBUG=20
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrateg=
y:100]=20
- Configuration specifies the following formats: []
2017-12-11 16:10:57,296 - DEBUG=20
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrateg=
y:110]=20
- No formats specified in configuration or in metadata, returning default=
2017-12-11 16:10:57,297 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile =
Action AddNameIDToSubjects: Candidate NameID formats:=20
[urn:oasis:names:tc:SAML:2.0:nameid-format:transient]
2017-12-11 16:10:57,297 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile =
Action *AddNameIDToSubjects: Trying to generate NameID with Format=20
urn:oasis:names:tc:SAML:2.0:nameid-format:transient**
**2017-12-11 16:10:57,298 - ERROR=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile =
Action AddNameIDToSubjects: Error while generating NameID*
org.opensaml.saml.common.SAMLException: Invalid=20
NameIdentifierGenerationService configuration
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 at=20
net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(Pr=
oxySAML2NameIDGenerator.java:62)
2017-12-11 16:10:57,299 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile =
Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty
2017-12-11 16:10:57,303 - DEBUG=20
[org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:26=
7]=20
- Profile Action AddSubjectConfirmationToSubjects: Attempting to add=20
SubjectConfirmation to assertions in outgoing Response
1st it tries to send a transient namedID , although I expected a=20
computed on the fly persitenID based on mail attribute regarding my=20
config /bean=3D"shibboleth.SAML2PersistentGenerator/**above*
*
2nd it fails =3D> Unable to generate a NameID, leaving empty
although finally there seems to be a transient namedID though !?
2017-12-11 16:10:57,563 - INFO [Shibboleth-Audit.SSO:241] -=20
20171211T151057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_411a=
a04d9cff0e56166ea4ac8e2725a4|<a class="moz-txt-link-freetext" href="https://services.renater.fr/shibboleth|http:=">https://services.renater.fr/shibboleth|http:=</a>
//shibboleth.net/ns/profiles/saml2/sso/browser|<a class="moz-txt-link-freetext" href="https://idp3.tem-tsp.eu/id=">https://idp3.tem-tsp.eu/id=</a>
p/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f6c77f00f87d=
fbee3b92b4581800aae4|procaccia|urn:oasis:names:tc:SAML:2.0:ac:classes:Pas=
swordProtectedTransport
|uid,mail,eduPersonPrincipalName||*_4c7ace16b2aa2056cec31abf2591e650*|
Where did I went wrong ?
regards .
</pre>
</body>
</html>