IdPv3 - eduPersonTargetedID - How to define and release this *name ID*?

[Waldbieser, Carl]

The log does indeed contain *much* more than what I have posted.  I can provide some more context, if that is helpful:

    DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:188] - Profile Action AddAttributeStatementToAssertion: Encoding attribute email as a SAML 2 Att
    ribute
    DEBUG [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:154] - Beginning to encode attribute email
    DEBUG [net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] - Encoding value waldbiec at lafayette.edu of attribute email
    DEBUG [net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191] - Completed encoding 1 values for attribute email
    DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:118] - Profile Action AddAttributeStatementToAssertion: Adding constructed AttributeStatement to
     Assertion _dbe6f35e281277b3c36e2c7b0d4c93ca 
--> DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects
    DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:
    unspecified
    DEBUG [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82] - Metadata specifies the following formats: []
    DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: [urn:oasis:names:tc:SAML:2.0:nameid-format:p
    ersistent]
    DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:117] - Metadata did not specify any formats, relying on configuration alone
    DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:2.0:nameid-format:per
    sistent]
    DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid
    -format:persistent
    DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
--> DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty
    DEBUG [org.opensaml.saml.saml2.profile.impl.AddSubjectConfirmationToSubjects:267] - Profile Action AddSubjectConfirmationToSubjects: Attempting to add SubjectConfirmation to asser
    tions in outgoing Response


I have added the arrows ("-->") at the start and end of what I thought was the most relevant section.  The way I am interpreting the logs is that the "unspecified" format is disabled (due to the relying party override?), the SP metadata has no format in it but the configuration specifies "persistent" (again in the relying party override).  The IdP tries to generate the nameid with that format, but it can't, so it leaves it empty.

If there is some other part of the log you think is relevant, let me know.  The whole thing is quite massive, and I am not entirely comfortable posting the entire thing on an open mail list.

I have the following levels set:
  idp.loglevel.idp = DEBUG
  idp.loglevel.messages = DEBUG
  idp.loglevel.opensaml = DEBUG

Yes, the attribute resolved:

  Attribute definition ... produced an attribute with 1 values

The attribute isn't released to the SP, but I read "As of V3.2.0, the attribute used as the source key need not be released (in the sense of an attribute filter policy) to the SP.".  I am using IdP version 3.2.1.

Thanks,
Carl

----- Original Message -----
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: "Shib Users" <users at shibboleth.net>
Sent: Thursday, March 17, 2016 1:31:39 PM
Subject: RE: IdPv3 - eduPersonTargetedID - How to define and release this *name ID*?

> I set up the relying party override with a "nameIDFormatPrecedence" of
> "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent".  I authenticate to
> an SP, but in the logs I see the following:

And nothing else? What about on DEBUG?

> In `saml-nameid.properties` I set the "idp.persistentId.sourceAttribute" and
> "idp.persistentId.salt" properties.

Is the source attribute being resolved successfully?

>  I thought this was sufficient to enable the
> "Computed" name ID generator.  Is there some logging setting I can set to
> determine *why* the NameID could not be generated?

There should be plenty more in the log than what you posted if it's sufficiently high.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net