Google Apps using Shibboleth

[Christopher Bongaarts]

On 12/3/2012 1:16 PM, Prasanna wrote:
> Paul/Chris,
>
> I have attached the log file....If you could see the last few lines, there
> seems to be some problem with the principal...please advice me reg that..

Indeed:

18:57:56.926 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:548] 
- Filtering out potential name identifier attributes which do not 
support one of the following formats: 
[urn:oasis:names:tc:SAML:1.1:nameidformat:unspecified]
18:57:56.926 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:573] 
- Removing attribute principal, it can not be encoded in to a name 
identifier of an acceptable format
18:57:56.926 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:573] 
- Removing attribute transientId, it can not be encoded in to a name 
identifier of an acceptable format
18:57:56.926 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:486] 
- No attributes for principal 'raj' support encoding into a supported 
name identifier format for relying party 'google.com/a/imperoidm.com'

Check the nameFormat on your AttributeDefinition for principal in 
attribute-resolver.xml; it should exactly match:

   nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

I think you're missing the hyphen.

You've also still got the double nameID problem (you'll need to remove 
transientID from the attribute filter policy with id "releaseToAnyone" 
to fix that).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%