IdP 3 and Okta/Adobe SSO NameId

[James McCartin]

Here is the correct text for the saml-nameid.xml and relying-party.xml files:

saml-nameid.xml file:

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

                                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                                                p:format="urn:oasis:names:tc:SAML:1.1:nameid-format: emailAddress"
                                                p:attributeSourceIds="#{ {'mail'} }">

                                                <property name="activationCondition">
                                                                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://www.okta.com/saml2/service-provider/loysp" />
                                                </property>
                                </bean>

    </util:list>

relying-party.xml file:

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://www.okta.com/saml2/service-provider/loysp">
                               <property name="profileConfigurations">
                                              <list>
                                                                <bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptNameIDs="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
                                              </list>
                               </property>
               </bean>


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of James McCartin
Sent: Tuesday, November 29, 2016 10:19 AM
To: users at shibboleth.net
Subject: IdP 3 and Okta/Adobe SSO NameId


This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing<http://aka.ms/LearnAboutSpoofing>

Feedback<http://aka.ms/SafetyTipsFeedback>

I'm running into an issue trying to get my IdP integrated with Okta/Adobe.

Their documentation contains the following:

In addition to these custom attributes, you must configure the Subject attribute's NameId field to contain the value of the user's login username or e-mail (as configured in the Adobe Enterprise Dashboard). If you use Shibboleth as your IdP, see their documentation for configuring the NameIdfield

The Adobe metadata has the following:

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>

I made the following changes:

saml-nameid.xml file:

    <!-- SAML 2 NameID Generation -->
    <util:list id="shibboleth.SAML2NameIDGenerators">

        <ref bean="shibboleth.SAML2TransientGenerator" />

                                <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
                                                p:format="urn:oasis:names:tc:SAML:1.1:nameid-format: emailAddress"
                                                p:attributeSourceIds="#{ {'mail'} }">

                                                <property name="activationCondition">
                                                                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://www.okta.com/saml2/service-provider/loysp" />
                                                </property>
                                </bean>

    </util:list>

relying-party.xml file:

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://www.okta.com/saml2/service-provider/loysp">
                               <property name="profileConfigurations">
                                              <list>
                                                                <bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptNameIDs="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
                                              </list>
                               </property>
               </bean>

In my idp-process.log I have the following:

DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:100] - Configuration specifies the following formats: [urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress]
DEBUG [net.shibboleth.idp.saml.profile.logic.DefaultNameIdentifierFormatStrategy:121] - Filtered non-metadata-supported formats from configured formats, leaving: []

Adobe Event Logs shows the following error:

Inbound SAML login failed with message: The SAML response does not have NameId in the assertion

What do I need to do to send the NameId as emailAddress.  I went through the steps found here: https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration for a CustomNameID.

Thanks,

James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161129/9c762969/attachment-0001.html>