Invalid NameIdentifierGenerationService

[Phil Lello]

Hi,

I'm trying to get persistent nameIds working on my test IdP, but am having
trouble when I try to add DB backing.

Any help much appreciated.

My log shows:

2015-11-06 22:26:04,864 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile
Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion
Subjects
2015-11-06 22:26:04,865 - DEBUG
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:215]
- Applying policy to NameIDPolicy with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2015-11-06 22:26:04,866 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:316] - Profile
Action AddNameIDToSubjects: Request specified NameID format:
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2015-11-06 22:26:04,866 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile
Action AddNameIDToSubjects: Trying to generate NameID with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2015-11-06 22:26:04,872 - ERROR
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile
Action AddNameIDToSubjects: Error while generating NameID
org.opensaml.saml.common.SAMLException: Invalid
NameIdentifierGenerationService configuration
    at
net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)
2015-11-06 22:26:04,873 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile
Action AddNameIDToSubjects: Request specified use of an unsupportable
identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2015-11-06 22:26:04,876 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] -
Error event InvalidNameIDPolicy will be handled with response

saml-nameid.properties:
 Properties involving SAML NameIdentifier/NameID generation/consumption
# See saml-nameid.xml and c14n/subject-c14n.xml for advanced settings

# Set to shibboleth.StoredTransientIdGenerator for server-side storage
idp.transientId.generator = shibboleth.StoredTransientIdGenerator

# Set to shibboleth.StoredPersistentIdGenerator for db-backed storage
# and uncomment/name the PersistentIdStore bean to use
idp.persistentId.generator = shibboleth.StoredPersistentIdGenerator
idp.persistentId.store = PersistentIdStore
# Set this to null to skip hash-based generation of first stored ID
#idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator
idp.persistentId.computed = null

# Otherwise for computed PersistentIDs set the source attribute and salt.
idp.persistentId.sourceAttribute = uid
idp.persistentId.salt = spice0fLife
idp.persistentId.algorithm = SHA

# Comment out to disable legacy NameID generation via Attribute Resolver
#idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator
#idp.nameid.saml1.legacyGenerator =
shibboleth.LegacySAML1NameIdentifierGenerator

# Default NameID formats to use when nothing else is called for
idp.nameid.saml2.default =
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
#idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier

saml-nameid.xml:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy"

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <ref bean="shibboleth.SAML2PersistentGenerator" />

    </util:list>

    <!-- SAML 1 NameIdentifier Generation -->
    <util:list id="shibboleth.SAML1NameIdentifierGenerators">
        <ref bean="shibboleth.SAML1TransientGenerator" />
    </util:list>

    <bean id="PersistentIdStore"
parent="net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStore">
        <property name="dataSource">
            <bean class="org.apache.commons.dbcp2.BasicDataSource"
                p:driverClassName="org.h2.Driver"
                p:url="jdbc:h2:/opt/shibboleth-idp/PersistentIdStore.h2"
                p:username="sa"
                p:password=""
                p:maxIdle="5"
                p:maxWaitMillis="15000"
                p:testOnBorrow="true"
                p:validationQuery="select 1"
                p:validationQueryTimeout="5" />
        </property>
    </bean>
</beans>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151106/dd9d5a27/attachment.html>