Error while creating bean with name "searchUsername" for AttributePostLoginC14NConfiguration

[Roderick Grau]

The copy and paste was clean.  The script example is probably broken - but not the problem at the moment since that is not the path to go down anyway.

I did the configuration in small-nameid.xml from the CustomNameIDGenerationConfiguration wiki page for the SAML 2.0 E-mail format.

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

        <ref bean="shibboleth.SAML2PersistentGenerator" />

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" >

            <property name="activationCondition">
              <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://test-idm.suny.edu/fed/sp/metadata" />
            </property>
        </bean>
    </util:list>


I also did the config in saml-nameid.properties:

idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient
idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier

# Set to shibboleth.StoredTransientIdGenerator for server-side transient ID storage
idp.transientId.generator = shibboleth.CryptoTransientIdGenerator

# Persistent IDs can be computed on the fly with a hash, or managed in a database

# For computed IDs, set a source attribute and a secret salt:
idp.persistentId.sourceAttribute = uid
idp.persistentId.useUnfilteredAttributes = true
# Do *NOT* share the salt with other people, it's like divulging your private key.
idp.persistentId.algorithm = SHA
idp.persistentId.salt = **hidden**

# To use a database, use shibboleth.StoredPersistentIdGenerator
idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator
idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator

Hopefully I just have something oin the wrong place.  I don’t really want to just duplicate the v2 config, because it will have to be fixed at some point.

Thank you again for the reply.
-Rod

> On Jan 12, 2016, at 3:47 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> Straight copy and paste from the wiki page for the attribute resolver script.
> 
> Then the example's wrong or the paste is, but the script didn't work. A long script like that could have errors or you could be using Chrome and pasting bad characters or something like that.
> 
>> I am trying to duplicate what I had in v2 where I set the nameid-
>> format:persistent in relying-party.xml for an SP.  They need the uid in the
>> saml-nameid not to be encrypted.
> 
> Well, that isn't something you use that particular feature to configure.
> 
> Also a persistent NameID is opaque, generally, but not encrypted. It should never be non-opaque unless you have a really good reason, and you never, ever, ever use the same format with two different SPs but with a different kind of value. So if they need a NameID that's non-opaque, they cannot do that with the persistent format.
> 
>> I have done the settings from the NameIDGenerationConfiguration page and
>> the PersistentNAmeIDGenerationConfiguration page.  I just seem to be
>> missing the “don’t encrypt” it setting.
> 
> If you need a different kind of NameID for an SP, you can generate one based on an attribute as described in [1]. The format in that case is not "persistent".
> 
> You can also temporarily just reuse the original configuration, that still works. Encoding NameIDs with the resolver is fully supported, just deprecated.
> 
> But you should certainly not be generating one that contains a user's username and calling it a persistent NameID.
> 
> There is no "don't encrypt" setting, because there is no encryption involved.
> 
> -- Scott
> 
> [1] https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

--
Roderick Grau
Enterprise Infrastructure Services
University at Albany
1400 Washington Avenue Ext.
Albany, New York 12222