question regarding status:InvalidNameIDPolicy message

[David Massie]

I am getting an error from my shibb instance when I try to log into a
vendor's SP and I am hoping someone can offer advise. I am using shibb
2.1..5 and I am trying to authenticate with one45.com.

When I send the assertion I can see an error message in the assertion. Here
is the snip:

<saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
       </saml2p:StatusCode><saml2p:StatusMessage>NameID Format not
supported: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
</saml2p:StatusMessage>

The vendor's test login page shows error messages:

SimpleSAML_Error_Error: UNHANDLEDEXCEPTION

Backtrace:

0 /var/www/simplesamlphp/www/module.php:180 (N/A)

Caused by: sspmod_saml_Error: Responder/InvalidNameIDPolicy: NameID Format
not supported: urn:oasis:names:tc:SAML:2.0:nameid-format:transient

Backtrace:

3 /var/www/simplesamlphp/modules/saml/lib/Message.php:368
(sspmod_saml_Message::getResponseError)

2 /var/www/simplesamlphp/modules/saml/lib/Message.php:489
(sspmod_saml_Message::processResponse)

1 /var/www/simplesamlphp/modules/saml/www/sp/saml2-acs.php:50 (require)

0 /var/www/simplesamlphp/www/module.php:135 (N/A)


It seems to be telling me I am sending the nameID in the wrong format.


Here is my attribute resolver snip for the relevant attributes:

   <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"

         sourceAttributeID="uid" >

         <resolver:Dependency ref="affLDAP" />

              <resolver:AttributeEncoder xsi:type="SAML2StringNameID"

                 xmlns="urn:mace:shibboleth:2.0:attribute:encoder"


 nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />

    </resolver:AttributeDefinition >


and


  <resolver:AttributeDefinition id="uid" xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"

        sourceAttributeID="uid" >

       <resolver:Dependency ref="affLDAP" />

        <resolver:AttributeEncoder xsi:type="SAML1String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"

            name="urn:mace:dir:attribute-def:uid" />

        <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"

            name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />

    </resolver:AttributeDefinition>


Now, here is my attribute filter statement for one45.com:

    <AttributeFilterPolicy id="one45Policy">

        <PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="https://georgetown.one45.com" />

    <AttributeRule attributeID="principal">

        <PermitValueRule xsi:type="basic:ANY" />

    </AttributeRule>

        <AttributeRule attributeID="uid">

            <PermitValueRule xsi:type="basic:ANY" />

        </AttributeRule>

    </AttributeFilterPolicy>

Does anyone have a notion what I am doing wrong?

Thanks,

Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120404/deb6c3cc/attachment-0001.html