Release NameID as UID

[Johan Åkerstrøm]

OK,

Still not there...
Here is my log:

2015-09-06 00:38:52,879 - DEBUG [net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] - Encoding value johak of attribute customId
2015-09-06 00:38:52,880 - DEBUG [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191] - Completed encoding 1 values for attribute customId
2015-09-06 00:38:52,882 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:117] - Profile Action AddAttributeStatementToAssertion: Add
ing constructed AttributeStatement to Assertion _deae0d95de391081fe3e95ac86b0c891
2015-09-06 00:38:52,991 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoin
g Assertion Subjects
2015-09-06 00:38:52,993 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:139] - No object to operate on, returning true
2015-09-06 00:38:52,993 - DEBUG [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82] - Metadata specifies the following formats: [urn:oasis:
names:tc:SAML:1.1:nameid-format:X509SubjectName]
2015-09-06 00:38:52,994 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: []
2015-09-06 00:38:52,995 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:113] - Configuration did not specify any formats, relying on
metadata alone
2015-09-06 00:38:52,996 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasi
s:names:tc:SAML:1.1:nameid-format:X509SubjectName]
2015-09-06 00:38:52,997 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Form
at urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
2015-09-06 00:38:53,004 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects: Error while generating NameID
org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration
        at net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)
2015-09-06 00:38:53,024 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leavin
g empty



Here is attribute-resolver:

	<resolver:AttributeDefinition
                        id="customId"
                        xsi:type="ad:Simple"
                        sourceAttributeID="cn">
                <resolver:Dependency ref="eDirectory" />
                <resolver:AttributeEncoder
                                xsi:type="enc:SAML2String"
                                name="customId"
                                friendlyName="customId"
                                encodeType="false" />
       	</resolver:AttributeDefinition>

Here is my saml-nameid.xml:

    <util:list id="shibboleth.SAML2NameIDGenerators">
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"
            p:attributeSourceIds="#{ {'customId'} }" />
    </util:list>

Here is my saml-nameid.properties:

	idp.persistentId.generator = shibboleth.SAML2AttributeSourcedGenerator
	idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
	idp.persistentId.sourceAttribute = customId

Best Regards,
Johan Akerstrom
 
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, September 4, 2015 12:00 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Release NameID as UID

On 9/3/15, 5:44 PM, "users on behalf of Johan Åkerstrøm" <users-bounces at shibboleth.net on behalf of Johan.Akerstrom at skill.no> wrote:

>I’ve seen several threads about this, tried multiple things but can’t get it going.

Whatever you're following is *wrong*, so stop.

> 
>So this is my current config, probably a bit screwed up now but I get more confused by the minute now, so need som help:

All of that is outdated, that's 2.x material.

The email I sent outlining how to generate a custom identifier is here [1]. The same material is in the wiki, but slightly less explicitly. It is really not a big deal.

The only difference is that you're using "unspecified". Claiming that the SP "requires" that is not compelling evidence, so my advice to start with is that you configure something that isn't "unspecified" and if that works, great.

But if you must, the only difference is that you can't use the SP's metadata to trigger the result you need, you will have to create a RelyingParty override for that SP and specify the URN of the format you need in the nameIDFormatPrecedence property of the profile configuration(s) you add to the override.

It works. It is NOT hard.

If it doesn't work, STOP and ask and post a log snippet.

-- Scott

[1] http://marc.info/?l=shibboleth-users&m=143524088631467&w=2


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net