Incoming SAML message has no valid value for username attribute. Please verify ServiceProvider configuration in Identity Provider.

Mon Jun 27 05:13:18 EDT 2016

Hello Experts,

How do i configure Name attribute as "username" instead of
Name="urn:oid:0.9.2342.19200300.100.1.1" in shibboleth IDP 3.2.1?

Thanks,
Muthu

On Mon, Jun 27, 2016 at 2:19 PM, Muthuraman Sethuraman Sethuraman (US -
Advisory) <muthuraman.sethuraman at pwc.com> wrote:

> I have configured the IDP to release uid and email.
> But on the SP side, i keep getting this error...
> Please let me know how do i overcome this?
>
> <saml2:AttributeStatement>
> <saml2:Attribute FriendlyName="uid"
> Name="urn:oid:0.9.2342.19200300.100.1.1"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>skulkarni</saml2:AttributeValue>
> </saml2:Attribute>
> <saml2:Attribute FriendlyName="mail"
> Name="urn:oid:0.9.2342.19200300.100.1.3"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>
> skulkarni at example.org</saml2:AttributeValue>
> </saml2:Attribute>
> </saml2:AttributeStatement>
> </saml2:Assertion></saml2p:Response>
>
> 2016-06-27 03:52:33.562 -0400 (,,,) catalina-exec-3 : DEBUG
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter - Found
> XSAny attribute: urn:oid:0.9.2342.19200300.100.1.1 with value of: skulkarni
> 2016-06-27 03:52:33.562 -0400 (,,,) catalina-exec-3 : DEBUG
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter - Found
> XSAny attribute: urn:oid:0.9.2342.19200300.100.1.3 with value of:
> skulkarni at example.org
> 2016-06-27 03:52:33.562 -0400 (,,,) catalina-exec-3 : DEBUG
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter -
> SAMLResponse attributes: {urn:oid:0.9.2342.19200300.100.1.3=
> skulkarni at example.org, urn:oid:0.9.2342.19200300.100.1.1=skulkarni}
> 2016-06-27 03:52:33.562 -0400 (,,,) catalina-exec-3 : ERROR
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter - SAML
> Authentication Failed, please contact the administrator.
> org.springframework.security.authentication.AuthenticationServiceException:
> Incoming SAML message has no valid value for username attribute. Please
> verify ServiceProvider configuration in Identity Provider.
> at
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter.getUser(SAMLExtendedProcessingFilter.java:425)
> at
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter.handleSuccess(SAMLExtendedProcessingFilter.java:214)
> at
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter.attemptAuthentication(SAMLExtendedProcessingFilter.java:170)
> at
> org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211)
> at
> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at
> org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
> at
> org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:166)
> at
> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at
> org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
> at
> org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
> at
> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at
> org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
> at
> org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at
> org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
> at
> org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
> at
> org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
> at
> org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
> at
> org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:85)
> at
> org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
> at
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:503)
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421)
> at
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)
> at
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
> at
> org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2466)
> at
> org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2455)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at
> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
> at java.lang.Thread.run(Thread.java:745)
> 2016-06-27 03:52:33.562 -0400 (,,,) catalina-exec-3 : DEBUG
> com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter - SAML
> login failed due generic exception Incoming SAML message has no valid value
> for username attribute. Please verify ServiceProvider configuration in
> Identity Provider.
> 2016-06-27 03:52:33.562 -0400 (,,,) catalina-exec-3 : INFO
>  com.tableausoftware.domain.user.saml.SAMLExtendedProcessingFilter - SAML
> login failed, redirecting user to /#/error/saml/16
> Thanks,
> Muthu
>
> --
> *Muthuraman S*
> PwC | SDC Manager | IdAM
> Office: +1 404-838-4445 | Mobile: +91-9886302072
> Email: muthuraman.sethuraman at pwc.com
> PricewaterhouseCoopers LLP
> EGL Business Park, Bengaluru, India
> http://www.pwc.com/us
>

-- 
*Muthuraman S*
PwC | SDC Manager | IdAM
Office: +1 404-838-4445 | Mobile: +91-9886302072
Email: muthuraman.sethuraman at pwc.com
PricewaterhouseCoopers LLP
EGL Business Park, Bengaluru, India
http://www.pwc.com/us

______________________________________________________________________
The information transmitted, including any attachments, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited, and all liability arising therefrom is disclaimed. If you received this in error, please contact the sender and delete the material from any computer. PricewaterhouseCoopers LLP is a Delaware limited liability partnership.  This communication may come from PricewaterhouseCoopers LLP or one of its subsidiaries.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160627/43f32361/attachment-0001.html>