Subject Canonicalization problem

[Doan, Tommy]

I want to allow user logons at our v3 IdP with either sAMAccountName or userPrincipalName. I made the following changes to ldap.properties, and logons succeed with either username.

idp.authn.LDAP.userFilter = (|(sAMAccountName={user})(userPrincipalName={user}))
idp.attribute.resolver.LDAP.searchFilter = (|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName))

However, I want a consistent principal name used in the IdP, particularly for our interaction with Box. I'm trying to get Subject Canonicalization to work and running into problems.

Following https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-Post-LoginCanonicalization, I've enabled the bean in subject-c14n.xml.
    <util:list id="shibboleth.PostLoginSubjectCanonicalizationFlows">
        <bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" />
        <ref bean="c14n/x500" />
        <ref bean="c14n/simple" />
    </util:list>

And I've added an attribute that's present in attribute-resolver.xml to attribute-sourced-subject-c14n-config.xml.
    <util:list id="shibboleth.c14n.attribute.AttributesToResolve">
        <value>userPrincipalName</value>
    </util:list>
    <util:list id="shibboleth.c14n.attribute.AttributeSourceIds">
        <value>userPrincipalName</value>
    </util:list>

With this configuration, the IdP starts up fine but logon attempts result in a type mismatch error. This may be a bug.


2015-11-07 10:09:09,297 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ResolveAttributes' defined in file [C:\Program Files (x86)\Shibboleth\IdP\system\flows\c14n\attribute-sourced-subject-c14n-beans.xml]: Initialization of bean failed; nested exception is org.springframework.beans.TypeMismatchException: Failed to convert property value of type 'java.lang.String' to required type 'boolean' for property 'maskFailures'; nested exception is java.lang.IllegalArgumentException: Invalid boolean value [%{idp.service.attribute.resolver.maskFailures:true}]

       at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:547)

Caused by: org.springframework.beans.TypeMismatchException: Failed to convert property value of type 'java.lang.String' to required type 'boolean' for property 'maskFailures'; nested exception is java.lang.IllegalArgumentException: Invalid boolean value [%{idp.service.attribute.resolver.maskFailures:true}]

       at org.springframework.beans.BeanWrapperImpl.convertIfNecessary(BeanWrapperImpl.java:481)

Caused by: java.lang.IllegalArgumentException: Invalid boolean value [%{idp.service.attribute.resolver.maskFailures:true}]

       at org.springframework.beans.propertyeditors.CustomBooleanEditor.setAsText(CustomBooleanEditor.java:122)

I've found I can make either of the following changes to attribute-sourced-subject-c14n-beans.xml, and logons become successful.

Change:
   p:maskFailures="%{idp.service.attribute.resolver.maskFailures:true}"
To either:
   p:maskFailures="true"
or:
  p:maskFailures="false"

Moving on however, idp-process.log indicates c14n subject resolution is not occurring. Have I missed a step?

2015-11-07 21:44:56,415 - INFO [org.ldaptive.auth.Authenticator:259] - Authentication succeeded for dn: CN=****,OU=People,OU=****,DC=****,DC=****
2015-11-07 21:44:56,415 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by ****@****.***' succeeded
2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:274] - Profile Action ValidateUsernamePasswordAgainstLDAP: Adding custom Principal(s) defined on underlying flow descriptor
2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 3 canonicalization flows into SubjectCanonicalizationContext
2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/attribute for applicability...
2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/attribute
2015-11-07 21:44:56,415 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:183] - Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute resolution
2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:191] - Attribute Resolver 'ShibbolethAttributeResolver': Attempting to resolve the following attribute definitions [sAMAccountName, userPrincipalName]
2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:360] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'sAMAccountName'
2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:310] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector myLDAP
2015-11-07 21:44:56,430 - DEBUG [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.TemplatedExecutableSearchFilterBuilder:203] - Template text (|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName)) yields (|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName))
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.StringAttributeValueMappingStrategy:58] - Results did not contain any entries, nothing to map
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:89] - myLDAP no attributes were produced during resolution
2015-11-07 21:44:56,508 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'myLDAP' produced no value.
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:338] - Attribute Resolver 'ShibbolethAttributeResolver': Data connector 'myLDAP' produced no attributes
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:376] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for sAMAccountName
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:245] - Attribute Definition 'sAMAccountName': produced an attribute with no values
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'sAMAccountName' produced an attribute with 0 values
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:360] - Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies for 'userPrincipalName'
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:376] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for userPrincipalName
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:245] - Attribute Definition 'userPrincipalName': produced an attribute with no values
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'userPrincipalName' produced an attribute with 0 values
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:201] - Attribute Resolver 'ShibbolethAttributeResolver': Finalizing resolved attributes
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:414] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute definition 'sAMAccountName', contains no values
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:414] - Attribute Resolver 'ShibbolethAttributeResolver': Removing result of attribute definition 'userPrincipalName', contains no values
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:206] - Attribute Resolver 'ShibbolethAttributeResolver': Final resolved attribute collection: []
2015-11-07 21:44:56,508 - WARN [net.shibboleth.idp.authn.impl.AttributeSourcedSubjectCanonicalization:146] - Profile Action AttributeSourcedSubjectCanonicalization: No attributes found, canonicalization not possible
2015-11-07 21:44:56,508 - INFO [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:62] - Profile Action SelectSubjectCanonicalizationFlow: Moving incomplete flow c14n/attribute to intermediate set, reselecting a different one
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability...
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this request
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicability...
2015-11-07 21:44:56,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/simple


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151108/17da670c/attachment-0001.html>