Delegation IDP internal error

[Brent Putman]

On 7/29/12 11:35 AM, Eddie Harari wrote:
> 21:25:35.300 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.ext.delegation.profile.LibertyIDWSFSSOSProfileHandler:898]
> - Attempting to resolve principal name from assertion token presented
> by 'http://sp.zehut.org/', with NameID format
> 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' and value
> 'eddie'

Based on this, the assertion that was generated on initial SSO and now
being presented back to the IdP as the delegated authN token has that
NameID format and value.


> 21:25:35.300 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:539]
> - Resolving principal name for subject of SAML request 'null' from
> relying party 'http://sp.zehut.org/'
> 21:25:35.300 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:201]
> - Resolving principal name from name identifier of format:
> urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
> 21:25:35.300 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:222]
> - Using principal connector saml1Unspec to resolve principal name.

It looks like it's attempting to use a PrincipalConnector with id
'saml1Unspec' to map the NameID back to a principal name.


> 21:25:35.300 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:551]
> - Error resolving principal name for SAML request 'null' from relying
> party 'http://sp.zehut.org/'. Cause: No information associated with
> transient identifier: eddie

That PrincipalConnector appears to be one for transient ID's, which is
clearly not correct if the NameID value was 'eddie'.


> 21:25:35.300 - WARN
> [edu.internet2.middleware.shibboleth.idp.ext.delegation.profile.LibertyIDWSFSSOSProfileHandler:911]
> - Error resolving principal name from assertion token presented by
> 'http://sp.zehut.org/', with NameID format
> 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified' and value
> 'eddie'
>


You need to reconcile the type of NameID being generated in the
Assertion on SSO to the initial SP (http://sp.zehut.org/) with the
PrincipalConnectors you have configured.  The IdP must be able to
successfully map the NameID value back to a principal name.  Either 1)
reconfigure to issue transient ID's in the Assertion or else 2)
configure a PrincipalConnector for the 'unspecified' NameID format that
works.  Take a look at the wiki page(s) below and, for option # 2,
probably the PrincipalConnector of type 'Direct'.


https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

--Brent