NameID generation for email failed when format is not set explicit on SessionInitiator

Thu Aug 4 03:59:18 EDT 2016

Hi

I want to use the urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress NameIDFormat.

This is my idp configuration

idp-metadata.xml

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

attribute-resolver.xml

<resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
    </resolver:AttributeDefinition>

attribute-filter.xml

 <AttributeRule attributeID="mail">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

saml-nameid.xml

  <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />

accli command line test

{
"requester": "https://sp.whatever/shibboleth"<https://sp.whatever/shibboleth>,
"principal": "p.brunmayr",
"attributes": [

  {
    "name": "uid",
    "values": [
              "StringAttributeValue{value=p.brunmayr}"          ]
  },

  {
    "name": "mail",
    "values": [
              "StringAttributeValue{value=p.brunmayr at foobar.at}"<mailto:StringAttributeValue{value=p.brunmayr at foobar.at}>          ]
  }

]
}

When i test my sp against the idp i can log in and everything works fine. Inspecting the log for the NameId generation tells me

2016-08-04 08:44:55,762 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects
2016-08-04 08:44:55,762 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2016-08-04 08:44:55,762 - DEBUG [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82] - Metadata specifies the following formats: []
2016-08-04 08:44:55,763 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: []
2016-08-04 08:44:55,763 - DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:110] - No formats specified in configuration or in metadata, returning default
2016-08-04 08:44:55,763 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:2.0:nameid-format:transient]
2016-08-04 08:44:55,764 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient
2016-08-04 08:44:55,764 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient
2016-08-04 08:44:55,764 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty

By the way i have no support for urn:oasis:names:tc:SAML:2.0:nameid-format:transient but it seems its from idp.nameid.saml2.default setting.

But when i set on the SP side like this

<SSO NameIDFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"  entityID="https://sso.whatever/idp"<https://sso.whatever/idp>>
              SAML2
            </SSO>

i get

2016-08-04 09:27:02,886 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects
2016-08-04 09:27:02,886 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-08-04 09:27:02,886 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:316] - Profile Action AddNameIDToSubjects: Request specified NameID format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-08-04 09:27:02,887 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-08-04 09:27:02,887 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-08-04 09:27:02,889 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:197] - Checking for source attribute mail
2016-08-04 09:27:02,889 - DEBUG [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:216] - Generating NameID from String-valued attribute mail
2016-08-04 09:27:02,890 - DEBUG [org.opensaml.saml.saml2.profile.AbstractSAML2NameIDGenerator:96] - Generating NameID p.brunmayr at foobar.at<mailto:p.brunmayr at foobar.at> with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-08-04 09:27:02,891 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:118] - Successfully generated identifier with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-08-04 09:27:02,891 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:400] - Profile Action AddNameIDToSubjects: Successfully generated NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-08-04 09:27:02,891 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:358] - Profile Action AddNameIDToSubjects: Added NameID to 1 assertion subject(s)

Does the idp always use the idp.nameid.saml2.default settings when no samlp:NameIDPolicy is present ? Why does he not check the supportted NameIDFormat elements in idp.metadata.xml. Who is responsible for selecting the
format ?

Thx

LINZ AG für Energie, Telekommunikation, Verkehr und Kommunale Dienste
A-4021 Linz, Wiener Straße 151, Postfach 1300, Tel. +43/732/3400-0, E-Mail: info at linzag.at

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160804/f5b186c7/attachment-0001.html>