Config email address as principal

[Klingenstein, Nate]

Doug,

A lot of the software that you are running is very old.  Tomcat 5, Centos 5, Java 6, and Shibboleth 2.4 are all either out of support or close enough.

I would try updating your software.

<md:RequestedAttribute FriendlyName="email" isRequired="true" Name="User Id" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>

This isn't a legal thing for them to ask for, for what it's worth.  The NameFormat indicates the Name will be a URI, but "User Id" is not a URI(or really standardized).

Not surprisingly when I attempt to access the SP with only a username, it fails to login, and generates this message in the logs:

No attribute of principal 'dcarter' can be encoded in to a NameIdentifier of required format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' for relying party 'foo.domain.com<http://foo.domain.com/>'

This indicates that the name selection process ended up choosing transient, likely because of an explicit request for a transient user nameID in metadata.

I've looked through the docs and Googled this a lot, and have seen others with a similar problem, but it's not clear to me what part of the config needs to be changed. I could pull the email address from LDAP, but since our usernames are unique, I don't know why just hard-coding our domain to the username wouldn't work. This seems like a pretty common config that must come up, but so far I haven't found any good config examples that shows how it's done.

Any tips, pointers or other advice would be greatly appreciated.

I would:

1)  Update your software
2)  Ask the SP to choose a legal name, preferably using an attribute that already exists.  Consider "mail" or "urn:oasis:names:tc:SAML:1.1:email-address".  I might have the latter string off by a bit.

<we can jump in to help again at this point if you need it)

3)  Make sure their metadata properly asks for transient identifiers.
4)  Get the right attribute encoder in place
5)  Release the right attribute to the right SP

I'd do it in that order, if you could.

Take care,
Nate.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160906/10f48bf8/attachment-0001.html>