No NameID released

[Kevin Foote]

forgot to add...
Are you specifically blocking the release of your attribute in another filter?

--------
thanks
 kevin.foote

On Aug 11, 2014, at 1:42 PM, David Bantz <dabantz at alaska.edu> wrote:

> I do not understand why my IdP did not release a NameID in the subject portion of the SAML assertion to a particular relying party.
> I’ve reviewed https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
> 
> I was able to send the transientID value as NameID by adding it explicitly to the attribute release policy for this SP, so I’ve resolved the operational issue, but I would like to know why the ‘releaseTransientIdToAnyone’ policy did not cover this case.
> 
> the SP metadata includes:
>    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
>     <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
> 
> The IdP builds a TransientID:
> 09:15:25.234 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:97] - Building transient ID for request _3243897b9f3596fc1ccfb93040b1b10b; outbound message issuer: urn:mace:incommon:alaska.edu, inbound
>  message issuer: urn:amazon:webservices, principal identifer: dabantz
> 09:15:25.235 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:115] - Created transient ID _7a768c0d4ad1ad93e9623e5f23421e87 for request _3243897b9f3596fc1ccfb93040b1b10b
> 09:15:25.235 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute transientId containing 1 values
> 
> The attribute-filter contains the rule:
>     <AttributeFilterPolicy id="releaseTransientIdToAnyone">
>         <PolicyRequirementRule xsi:type="basic:ANY" />
>         <AttributeRule attributeID="transientId">
>             <PermitValueRule xsi:type="basic:ANY" />
>         </AttributeRule>
>     </AttributeFilterPolicy>
> 
> Yet the IdP releases no NameID to this service:
> 09:15:25.423 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:527] - Filtering out potential name identifier attributes which can not be encoded by edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
> 09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546] - Removing attribute AWSsessionID, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
> 09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:546] - Removing attribute AWSrole, it can not be encoded via edu.internet2.middleware.shibboleth.common.attribute.encoding.SAML2NameIDEncoder
> 09:15:25.424 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:504] - No attributes for principal 'dabantz' support encoding into a supported name identifier format for relying party 'urn:amazon:webservices'
> 
> resulting in a ‘nameless’ subject in the SAML assertion:
> <saml2:Subject>
> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
> <saml2:SubjectConfirmationData Address="137.229.6.68" NotOnOrAfter="2014-08-11T16:25:38.711Z" Recipient="
> https://signin.aws.amazon.com/saml
> "/>
> </saml2:SubjectConfirmation>
> </saml2:Subject>
> 
> 
> For OTHER relying parties /  SPs the IdP uses TransientID for the NameID, as in:
> 09:32:53.155 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:868] - Using attribute 'transientId' supporting NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' to create the NameID for relying party 'https://secure.aleks.com/shibboleth-sp'
> 09:32:53.155 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:733] - Attempting to encrypt NameID to relying party 'https://secure.aleks.com/shibboleth-sp'
> Value = org.opensaml.saml2.core.impl.NameIDImpl at 3cb8e2d7
> 
> 
> 
> David Bantz
> UA IAM
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net