Idp 3.x persistentId / shibsp-plugin-AttributeQuery-Handler

[Raffael Sahli]

Hi

Okay I have finally managed to get the persistent-id.

I have set the default to persistent. 
Probably I could configure the SP to request persistent, but I haven't found out how this works....
idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent


But now I get back a saml error.

Shibboleth SP (With attribute query extension):

python scripts/attributequery.py -d https://mysp.example.org/Shibboleth.sso/AttributeQuery 'https://myidp.example.org/idp/shibboleth!https://mysp.example.org/shibboleth!O/Nkcgxxxxbtqz/rhfYoOF4='
URL: https://mysp.example.org/Shibboleth.sso/AttributeQuery?entityID=https%3A%2F%2Fmyidp.example.org%2Fidp%2Fshibboleth&nameId=O%2FNkcgxxxxbtqz%2FrhfYoOF4%3D
JSON: {}
no attributes

SP Log:
2015-04-17 12:27:02 ERROR OpenSAML.SOAPClient [6]: SOAP client detected a SAML error: (urn:oasis:names:tc:SAML:2.0:status:Requester) (An error occurred.)
2015-04-17 12:27:02 ERROR Shibboleth.AttributeResolver.Query [6]: attribute authority returned a SAML error



Idp:
Error:
2015-04-17 12:33:03,305 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail


I'm right know not exactly sure if this is a problem with idp 3.x and the sp attribute query extension,
or just a misconfiguration.


More Debug informations:
2015-04-17 12:33:03,297 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
2015-04-17 12:33:03,298 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:192] - NameIDCanonicalizationFlowDescriptor c14n/SAML2Transient: no format matches
2015-04-17 12:33:03,298 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/SAML2Transient was not applicable to this request
2015-04-17 12:33:03,299 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/SAML2CryptoTransient for applicability...
2015-04-17 12:33:03,299 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
2015-04-17 12:33:03,300 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:192] - NameIDCanonicalizationFlowDescriptor c14n/SAML2CryptoTransient: no format matches
2015-04-17 12:33:03,300 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/SAML2CryptoTransient was not applicable to this request
2015-04-17 12:33:03,300 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/SAML1Transient for applicability...
2015-04-17 12:33:03,301 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/SAML1Transient was not applicable to this request
2015-04-17 12:33:03,301 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/SAML1CryptoTransient for applicability...
2015-04-17 12:33:03,302 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/SAML1CryptoTransient was not applicable to this request
2015-04-17 12:33:03,302 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/SAML2Transform for applicability...
2015-04-17 12:33:03,302 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
2015-04-17 12:33:03,303 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:192] - NameIDCanonicalizationFlowDescriptor c14n/SAML2Transform: no format matches
2015-04-17 12:33:03,303 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/SAML2Transform was not applicable to this request
2015-04-17 12:33:03,304 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/SAML1Transform for applicability...
2015-04-17 12:33:03,304 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/SAML1Transform was not applicable to this request
2015-04-17 12:33:03,305 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail



Thanks



On 3/31/15, 11:13 AM, "Raffael Sahli" <sahli at gyselroth.com> wrote:

>I have tried it before, but probably with a wrong encoder and probably a wrong attribute declaration :(
>
>357     <resolver:AttributeDefinition id="persistentId" xsi:type="ad:Simple" sourceAttributeID="persistentId">
>358         <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" 

The source attribute for the V3 code should be a simple string attribute, no encoder needed. You're producing a NameID directly. That's not the V3 way, that's the V2 way. If you want that, follow the old documentation, not the new.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net