Release NameID as UID

Wed Sep 16 01:47:58 EDT 2015

>>Action AddNameIDToSubjects: Trying to generate NameID with Form at 
>>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName

>Is there some reason you're using that format?

What I actually need is urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified, but I am stuck and getting confused now so I just posted what was my last try of very many tries.

>>2015-09-06 00:38:53,004 - ERROR 
>>[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - 
>>Profile Action AddNameIDToSubjects: Error while generating NameID
>>org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration
>>        at
>
> Well, you made the configuration unloadable, and it should tell you why in the log where it will track the loading of the configuration.

Well this is the rest of the log immediately after the error:

2015-09-06 00:38:53,004 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects: Error while generating NameID
org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration
        at net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)
2015-09-06 00:38:53,024 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty
2015-09-06 00:38:53,036 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:267] - Profile Action AddSubjectConfirmationToSubjects: Attempting to add SubjectConfirmation to assertions in outgoing Response
2015-09-06 00:38:53,038 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:127] - Profile Action AddSubjectConfirmationToSubjects: Setting confirmation data Address to 10.16.110.60
2015-09-06 00:38:53,039 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:137] - Profile Action AddSubjectConfirmationToSubjects: Setting confirmation data InResponseTo to _fb6755cf-6895-45a8-acd3-62dc0632a99c
2015-09-06 00:38:53,040 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:154] - Profile Action AddSubjectConfirmationToSubjects: Setting confirmation data Recipient to https://site.domain.com/saml/SAMLAssertionConsumer
2015-09-06 00:38:53,040 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:169] - Profile Action AddSubjectConfirmationToSubjects: Setting confirmation data NotOnOrAfter to 5 minutes from now
2015-09-06 00:38:53,043 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:336] - Profile Action AddSubjectConfirmationToSubjects: Added SubjectConfirmation with method urn:oasis:names:tc:SAML:2.0:cm:bearer to 1 assertion(s)
2015-09-06 00:38:53,054 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotBeforeConditionToAssertions:79] - Profile Action AddNotBeforeConditionToAssertions: Attempting to add NotBefore condition to every Assertion in outgoing Response
2015-09-06 00:38:53,055 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotBeforeConditionToAssertions:121] - Profile Action AddNotBeforeConditionToAssertions: Added NotBefore condition to Assertion _deae0d95de391081fe3e95ac86b0c891
2015-09-06 00:38:53,056 - DEBUG [org.opensaml.saml.saml2.profile.SAML2ActionSupport:126] - Profile Action AddNotBeforeConditionToAssertions: Assertion _deae0d95de391081fe3e95ac86b0c891 did not already contain Conditions, one was added
2015-09-06 00:38:53,069 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:114] - Profile Action AddNotOnOrAfterConditionToAssertions: Attempting to add NotOnOrAfter condition to every Assertion in outgoing Response
2015-09-06 00:38:53,071 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:169] - Profile Action AddNotOnOrAfterConditionToAssertions: Added NotOnOrAfter condition, indicating an expiration of 2015-09-05T22:43:52.766Z, to Assertion _deae0d95de391081fe3e95ac86b0c891
2015-09-06 00:38:53,071 - DEBUG [org.opensaml.saml.saml2.profile.SAML2ActionSupport:129] - Profile Action AddNotOnOrAfterConditionToAssertions: Assertion _deae0d95de391081fe3e95ac86b0c891 already contained Conditions, nothing was done
2015-09-06 00:38:53,084 - DEBUG [org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:147] - Profile Action AddAudienceRestrictionToAssertions: Attempting to add an AudienceRestrictionCondition to every Assertion in Response
2015-09-06 00:38:53,084 - DEBUG [org.opensaml.saml.saml2.profile.SAML2ActionSupport:129] - Profile Action AddAudienceRestrictionToAssertions: Assertion _deae0d95de391081fe3e95ac86b0c891 already contained Conditions, nothing was done
2015-09-06 00:38:53,085 - DEBUG [org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:290] - Profile Action AddAudienceRestrictionToAssertions: Adding new AudienceRestriction
2015-09-06 00:38:53,086 - DEBUG [org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:238] - Profile Action AddAudienceRestrictionToAssertions: Adding https://site.domain.com as an Audience of the AudienceRestriction
2015-09-06 00:38:53,089 - DEBUG [org.opensaml.saml.common.profile.impl.AddAudienceRestrictionToAssertions:192] - Profile Action AddAudienceRestrictionToAssertions: Added AudienceRestrictionCondition to Assertion _deae0d95de391081fe3e95ac86b0c891
2015-09-06 00:38:53,106 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddProxyRestrictionToAssertions:136] - Profile Action AddProxyRestrictionToAssertions: No audiences to add, nothing to do

>>Here is my saml-nameid.xml:

>I don't think that's the entire configuration, but you created an error in it somewhere.

No, this is it:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <util:list id="shibboleth.SAML2NameIDGenerators">
        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName"
            p:attributeSourceIds="#{ {'customId'} }" />
    </util:list>
    <util:list id="shibboleth.SAML1NameIdentifierGenerators">
        <ref bean="shibboleth.SAML1PersistentGenerator" />
    </util:list>
</beans>

>>Here is my saml-nameid.properties:
>>
>>	idp.persistentId.generator = shibboleth.SAML2AttributeSourcedGenerator
>>	idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
>>	idp.persistentId.sourceAttribute = customId

>None of that makes sense. You need to undo all of that and stop changing all those settings. There is nothing in that file you need to change, and there is no documentation telling you to change it.

I am sure it doesn't, but I am now just confused and try everything I see in different posts? So basically I need to grab the original file from the dist?

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net