Error Processing Profile Request

[Tabitha O. Locklear]

We are running an old version 2.0 that has the known bug.
We are hoping to upgrade soon, but in the meantime we have this issue.
Is there a workaround?

This is what we have in the attribute-resolver.xml


<!-- Name Identifier related attributes -->
    <resolver:AttributeDefinition id="transientId" xsi:type="TransientId" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
        <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
            xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:mace:shibboleth:1.0:nameIdentifier" />

        <resolver:AttributeEncoder xsi:type="SAML1StringNameIdentifier"
            xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />

        <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />

        <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" />
    </resolver:AttributeDefinition>

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, February 25, 2016 2:52 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Error Processing Profile Request

> - Using attribute transientId supporting NameID format 
> urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified to create the 
> NameID.

I think you must have done something very bad to your attribute resolver, but that's just a guess. If you did something crazy like attach an alternative NameID-capable AttributeEncoder to the transientId attribute definition, do not do that.

That said, the NPE is a bug, but that's moot, you're on 2.x and there will be no more bug fixes to 2.x. You can file it, on the off chance there's a security fix later but we'd likely be focused solely on issuing whatever minimal fix was needed at that time, not looking to fix minor bugs.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net