Apparent inconsistencies in the Shibboleth wiki concerning persistent NameIDs for federating a Shibboleth IDP with Microsoft Azure

[Florian Lengyel]

Florian,

...
There was a “Commercial Interop” section in the IdP V2 Wiki space where deployers could add helpful notes related to difficult integrations. I copied that section over to the V3 space and added this page ...
-WFH

Was this tested with V3? Now I see that adding  this portion of the example in section 5 of https://wiki.shibboleth.net/confluence/display/IDP30/Office+365

  <!-- Persistent ID Generator for all entities except Microsoft -->
    <bean parent="shibboleth.SAML2PersistentGenerator">
        <property name="activationCondition">
            <bean parent="shibboleth.Conditions.NOT">
                <constructor-arg>
                    <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{{'urn:federation:MicrosoftOnline'}}" />
                </constructor-arg>
            </bean>
        </property>
    </bean>

combined with an unmodified, original  saml-nameid.properties file  will lead to the errors  

2016-03-31 18:53:32,099 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.Na                   meIdentifierGenerationService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.BeanCreationException: Error creatin                   g bean with name 'shibboleth.SAML2NameIDGenerators': Cannot create inner bean 'shibboleth.SAML2PersistentGenerator$child#f33d21f' of t                   ype [net.shibboleth.idp.saml.nameid.impl.PersistentSAML2NameIDGenerator] while setting bean property 'sourceList' with key [1]; nested                    exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2PersistentGenera                   tor$child#f33d21f' defined in file [/opt/shibboleth-idp/conf/saml-nameid.xml]: Cannot resolve reference to bean '#{'shibboleth.Compute                   dPersistentIdGenerator'.trim()}' while setting bean property 'persistentIdGenerator'; nested exception is org.springframework.beans.fa                   ctory.BeanCreationException: Error creating bean with name 'shibboleth.ComputedPersistentIdGenerator' defined in file [/opt/shibboleth                   -idp/system/conf/saml-nameid-system.xml]: Error setting property values; nested exception is org.springframework.beans.PropertyBatchUp                   dateException; nested PropertyAccessExceptions (1) are:
PropertyAccessException 1: org.springframework.beans.MethodInvocationException: Property 'salt' threw exception; nested exception is n                   et.shibboleth.utilities.java.support.logic.ConstraintViolationException: Salt cannot be null or empty

Apparently, unless one wants a persistent NameID generator, perhaps for some other SP than Microsoft Azure, the above  portion of the configuration of saml-nameid.xml  mentioned in section 5 of https://wiki.shibboleth.net/confluence/display/IDP30/Office+365 
should be omitted; otherwise additional properties in saml-nameid.properties have to be set.
In my configuration, only the custom persistent NameID generator is needed--so far.

I think this could be mentioned in the documentation. I'm doing what https://wiki.shibboleth.net/confluence/display/IDP30/Office+365  and Michael A. Grady suggest, and shibboleth is sending the correct SAML assertions (Issuer, IDPEmail and NameID) that Azure presumably expects). The login failure may be a question of what was synchronized with Azure--this is in the hands of another group here.

It will be gratifying for CUNY, the largest urban public university in the United States, to adopt Shibboleth and to work with other SPs.

-F