Custom NameID Generation

[Michael Dahlberg]

On Fri, Mar 4, 2016 at 2:36 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I'm having a problem in IdP v3 (disabling all, I think, legacy v2
> support) custom
> > NameID generation:
>
> It isn't relevant, but you didn't in fact disable the backward
> compatibility.
>
> > Also, the source attribute 'mail' is correctly resolved.
>
> Your logs don't actually prove that, but assuming that's true...
>

2016-03-04 14:44:08,756 - DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] - Data
Connector 'myLDAP': Attribute 'mail': Values '[StringAttributeValue{value=
dahlberg at bucknell.edu}]'



>
> > (3) And released the "emailAddress" attribute from the
> attribute-filter.xml
> > file
>
> Which is it? mail or emailAddress? Taken literally, that's wrong.
>

Oh, that's my mistake.  I thought that the attribute 'mail' was used to
populate 'emailAddress' and that then 'emailAddress' should then be
released.

So you're saying that 'emailAddress' is a type of format and that 'mail'
should be released?

Releasing 'mail' within attribute-filter.xml results in the following:

2016-03-04 14:44:08,922 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:154]
- Beginning to encode attribute mail
2016-03-04 14:44:08,923 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] -
Encoding value dahlberg at bucknell.edu of attribute mail
2016-03-04 14:44:08,924 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191]
- Completed encoding 1 values for attribute mail


2016-03-04 14:44:08,944 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile
Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion
Subjects
2016-03-04 14:44:08,944 - DEBUG
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218]
- Policy checking disabled for NameIDPolicy with Format
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2016-03-04 14:44:08,945 - DEBUG
[org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82]
- Metadata specifies the following formats:
[urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]
2016-03-04 14:44:08,945 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100]
- Configuration specifies the following formats: []
2016-03-04 14:44:08,946 - DEBUG
[net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:113]
- Configuration did not specify any formats, relying on metadata alone
2016-03-04 14:44:08,946 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile
Action AddNameIDToSubjects: Candidate NameID formats:
[urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]
2016-03-04 14:44:08,946 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile
Action AddNameIDToSubjects: Trying to generate NameID with Format
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-03-04 14:44:08,947 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106]
- Trying to generate identifier with Format
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
2016-03-04 14:44:08,948 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile
Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty

And no NameID in the Subject.  Either conceptually I'm missing something or
I skipped some step.

Thanks again, Scott.

Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160304/719b4bb9/attachment.html>