SP-specific failure to generate 'good' SAML assertion

Tue Nov 12 15:09:57 EST 2013

Integrating vendor site and digesting their metadata.  Login attempt at their site successfully re-directs to our IdP and generates required attributes, but fails to produce expected SAML assertion of authN and attributes.
I see the warning that no attribute can be encoded as NameIdentifier in “required” format; “good” responses to other SPs have messages that no attribute can be encoded as NameIdentifier in “supported” format (not labeled warning).
I suspect this should tell me something useful, but admit I don’t understand what it’s telling me.  Your help appreciated,

David Bantz
U Alaska

Debug-level log fragment:

10:03:53.113 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:114] - Filtered attributes for principal dabantz.  The following attributes remain: [surname, email, eduPersonPrincipalName, givenName]
10:03:53.113 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:501] - Creating attribute statement in response to SAML request 'id-1fa5a56e5e1d2231ef97d750c8adce1a' from relying party 'www.fuzemeeting.com'
10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute surname with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder
10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute email with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder
10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute eduPersonPrincipalName with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2ScopedStringAttributeEncoder
10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:215] - Encoded attribute givenName with encoder of type edu.internet2.middleware.shibboleth.common.attribute.encoding.provider.SAML2StringAttributeEncoder
10:03:53.114 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:509] - Filtering out potential name identifier attributes which can not be encoded by edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute surname, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute email, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute eduPersonPrincipalName, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:528] - Removing attribute givenName, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
10:03:53.115 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:465] - Attempting to select name identifier attribute for relying party 'www.fuzemeeting.com' that requires format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
10:03:53.115 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:473] - No attribute of principal 'dabantz' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' for relying party 'www.fuzemeeting.com'
10:03:53.138 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:778] - Encoding response to SAML request id-1fa5a56e5e1d2231ef97d750c8adce1a from relying party www.fuzemeeting.com
10:03:53.138 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:49] - Beginning encode message to outbound transport of type: org.opensaml.ws.transport.http.HttpServletResponseAdapter
10:03:53.138 - DEBUG [org.opensaml.common.SAMLObjectHelper:56] - Examing signed object for content references with exclusive canonicalization transform
10:03:53.138 - DEBUG [org.opensaml.common.SAMLObjectHelper:70] - Saw exclusive transform, declaring non-visible namespaces on signed object
10:03:53.139 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:100] - Starting to marshall {http://www.w3.org/2000/09/xmldsig#}Signature
10:03:53.139 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:103] - Creating XMLSignature object
10:03:53.139 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:113] - Adding content to XMLSignature.
10:03:53.139 - DEBUG [org.opensaml.common.impl.SAMLObjectContentReference:174] - Adding list of inclusive namespaces for signature exclusive canonicalization transform
10:03:53.140 - DEBUG [org.opensaml.xml.signature.impl.SignatureMarshaller:118] - Creating Signature DOM element
10:03:53.140 - DEBUG [org.opensaml.xml.signature.Signer:76] - Computing signature over XMLSignature object
10:03:53.150 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:124] - Invoking Velocity template to create POST body
10:03:53.151 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:158] - Encoding action url of 'https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu' with encoded value 'https&#x3a;&#x2f;&#x2f;www.fuzemeeting.com&#x2f;fuze&#x2f;saml_verify&#x2f;alaskaedu'
10:03:53.151 - DEBUG [org.opensaml.saml2.binding.encoding.HTTPPostEncoder:161] - Marshalling and Base64 encoding SAML message
10:03:53.154 - DEBUG [PROTOCOL_MESSAGE:74] - 
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu" ID="_d4e8bfd0abb3f317c3118c6c6ae5b687" InResponseTo="id-1fa5a56e5e1d2231ef97d750c8adce1a" IssueInstant="2013-11-12T19:03:53.137Z" Version="2.0">
   <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:alaska.edu</saml2:Issuer>
   <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
         <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
         <ds:Reference URI="#_d4e8bfd0abb3f317c3118c6c6ae5b687">
            <ds:Transforms>
               <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
               <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>JfS1I36EYVMD150rFhQCabfhWiw=</ds:DigestValue>
         </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>tich/3vqKBzxBAeft7vmFfm2DnBE3x6v38gS4duzG8kL/LyBElBfrq/qOu7Q4l18DS4XUIV/7L7bVNcczIBNaJHrz6hRLnonBsilnGJmLB+4ttUN8dnqtTLikysNa34A9RbeCHM+If5G11NKJeqT+Bubb74h1g/hM5N4Tp8AjtCjtYyYfKuFzan9U/ytsFf82iC2++QWzR7GbvpGyz7CwEUDo1gXDsN8mLAC3krkagF4OKBsMdliMDhwBhy8D4Pq7GvXi7gjFBSalxti45Wv3f8pvmcIgd/+76+74GHBxxqdJ1r2DrA4u8O6cFhUKRg2VLg4jZ6hQMSXAo6ZRgyG0g==</ds:SignatureValue>
      <ds:KeyInfo>
         <ds:X509Data>
            <ds:...</ds:X509Certificate>
         </ds:X509Data>
      </ds:KeyInfo>
   </ds:Signature>
   <saml2p:Status>
      <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
         <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
      </saml2p:StatusCode>
      <saml2p:StatusMessage>Required NameID format not supported</saml2p:StatusMessage>
   </saml2p:Status>
</saml2p:Response>

10:03:53.155 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.
10:03:53.155 - INFO [Shibboleth-Audit:989] - 20131112T190353Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|id-1fa5a56e5e1d2231ef97d750c8adce1a|www.fuzemeeting.com|urn:mace:shibboleth:2.0:profiles:saml2:sso|urn:mace:incommon:alaska.edu|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_d4e8bfd0abb3f317c3118c6c6ae5b687|dabantz|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|surname,email,eduPersonPrincipalName,givenName,|||

Vendor’s metadata:

<ns0:EntityDescriptor xmlns:ns0="urn:oasis:names:tc:SAML:2.0:metadata" entityID="www.fuzemeeting.com">
	<ns0:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
		<ns0:KeyDescriptor>
			<ns1:KeyInfo xmlns:ns1="http://www.w3.org/2000/09/xmldsig#">
				<ns1:X509Data>
					<ns1:X509Certificate>...
					</ns1:X509Certificate>
				</ns1:X509Data>
			</ns1:KeyInfo>
		</ns0:KeyDescriptor>
		<ns0:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.fuzemeeting.com/fuze/saml_verify/alaskaedu" index="1"/>
	</ns0:SPSSODescriptor>
	<ns0:Organization>
		<ns0:OrganizationName xml:lang="en">FuzeBox</ns0:OrganizationName>
		<ns0:OrganizationDisplayName xml:lang="en">FB SAML</ns0:OrganizationDisplayName>
		<ns0:OrganizationURL xml:lang="en">https://www.fuzebox.com</ns0:OrganizationURL>
	</ns0:Organization>
	<ns0:ContactPerson contactType="technical"/>
</ns0:EntityDescriptor>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131112/7a3ec9f5/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20131112/7a3ec9f5/attachment-0001.bin 