Error resolving principal name

[Morris, Andi]

Hi all,
I'm getting the following error when users try to authenticate against a particular SP. Can someone please point me in the right direction to resolve this. I believe it might be because the SP is requesting a SAML1 transientID, but my IdP cannot resolve the attribute against the principal name.

20:33:56.393 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml1.AbstractSAML1ProfileHandler:568] - Error resolving principal name for SAML request from relying party 'https://academic.mintel.com/shibboleth'. Cause: No information associated with transient identifier: _15c9b9b5bd0c3aa11d088549e802a3dd

My setup is:
Redhat6 server
Apache httpd handling Kerberos authentication via mod_auth_kerb and the Remote_User handler
Tomcat6 is the AJP 8009 connector for Shibboleth
Java version: Sun JDK 1.7.0_71

My Name Identifier related attributes are:

    <!-- Name Identifier related attributes -->
    <resolver:AttributeDefinition id="transientId" xsi:type="ad:TransientId">
        <resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition id="principalName"
                                  xsi:type="ad:PrincipalName"
                                  dependencyOnly="true">
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition id="krb_principalname"
                                 xsi:type="ad:Mapped"
                                 sourceAttributeID="principalName"
                                 dependencyOnly="true" >
     <resolver:Dependency ref="principalName" />
     <ad:ValueMap>
         <ad:ReturnValue>$1</ad:ReturnValue>
         <ad:SourceValue>(.+)@INTERNAL.DOMAIN</ad:SourceValue>
     </ad:ValueMap>
    </resolver:AttributeDefinition>


    <resolver:AttributeDefinition id="krb_domain"
                                 xsi:type="ad:Mapped"
                                 sourceAttributeID="principalName"
                                 dependencyOnly="true" >
     <resolver:Dependency ref="principalName" />
     <ad:ValueMap>
         <ad:ReturnValue>internal.domain</ad:ReturnValue>
         <ad:SourceValue>(.+)@INTERNAL.DOMAIN</ad:SourceValue>
     </ad:ValueMap>
    </resolver:AttributeDefinition>

I've included the two Kerberos Attribute Definitions just in case they're related as they depend on the principal name, but I don't think they are. Can anyone help with this? Apologies if I've not included enough information, please let me know if you need more.

Cheers,
Andi
-------------------------------------
Andi Morris
IT Security Officer
Cardiff Metropolitan University
T: 02920 205720
E: amorris at cardiffmet.ac.uk<mailto:amorris at cardiffmet.ac.uk>
--------------------------------------

________________________________

[Cardiff Metropolitan University - 150 years of nurturing talent]<http://www.cardiffmet.ac.uk/cardiffmet150>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150226/d857a859/attachment.html