Error while generating NameID for Office365

Mon Apr 17 17:50:53 EDT 2017

Hello all, 

I'm trying to figure out why Shibboleth is not allowing me to generate a
nameID using the objectGUID for office 365. I've configured my IDP following
the configuration guide that was posted here:
https://wiki.shibboleth.net/confluence/display/IDP30/Office+365 and I've
done everything but setup by IdP to respond to ECP profile requests on step
2. Here is what my logs say:

2017-04-17 14:43:41,883 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:217] -
Profile Action AddStatusResponseShell: Setting Issuer to
https://209.129.116.15/idp/shibboleth
2017-04-17 14:43:41,884 - DEBUG
[org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:110] -
Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to
outgoing Response
2017-04-17 14:43:41,888 - DEBUG
[net.shibboleth.idp.saml.profile.impl.BaseAddAuthenticationStatementToAssertion:170]
- Profile Action AddAuthnStatementToAssertion: Attempting to add an
AuthenticationStatement to outgoing Assertion
2017-04-17 14:43:41,888 - DEBUG
[org.opensaml.saml.saml2.profile.SAML2ActionSupport:77] - Profile Action
AddAuthnStatementToAssertion: Created Assertion
_49c917d4ed3ea0deb393ed64e62562a8
2017-04-17 14:43:41,888 - DEBUG
[org.opensaml.saml.saml2.profile.SAML2ActionSupport:101] - Profile Action
AddAuthnStatementToAssertion: Added Assertion
_49c917d4ed3ea0deb393ed64e62562a8 to Response
_d2987f03db1fd1ecedb5b32a9d5a0dc6
2017-04-17 14:43:41,889 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAuthnStatementToAssertion:165]
- Profile Action AddAuthnStatementToAssertion: Added AuthenticationStatement
to Assertion _49c917d4ed3ea0deb393ed64e62562a8
2017-04-17 14:43:41,891 - DEBUG
[net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion:229]
- Profile Action AddAttributeStatementToAssertion: Attempting to add an
AttributeStatement to outgoing Assertion
2017-04-17 14:43:41,891 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
- Profile Action AddAttributeStatementToAssertion: Attempting to encode
attribute UserId as a SAML 2 Attribute
2017-04-17 14:43:41,891 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:188]
- Profile Action AddAttributeStatementToAssertion: Encoding attribute UserId
as a SAML 2 Attribute
2017-04-17 14:43:41,892 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:154]
- Beginning to encode attribute UserId
2017-04-17 14:43:41,892 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.SAMLEncoderSupport:73] -
Encoding value marc.test at csuci.edu of attribute UserId
2017-04-17 14:43:41,892 - DEBUG
[net.shibboleth.idp.saml.attribute.encoding.AbstractSAMLAttributeEncoder:191]
- Completed encoding 1 values for attribute UserId
2017-04-17 14:43:41,893 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:174]
- Profile Action AddAttributeStatementToAssertion: Attempting to encode
attribute AzureGUID as a SAML 2 Attribute
2017-04-17 14:43:41,893 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:204]
- Profile Action AddAttributeStatementToAssertion: Attribute AzureGUID did
not have a usable SAML 2 Attribute encoder associated with it, nothing to do
2017-04-17 14:43:41,893 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:118]
- Profile Action AddAttributeStatementToAssertion: Adding constructed
AttributeStatement to Assertion _49c917d4ed3ea0deb393ed64e62562a8
2017-04-17 14:43:41,895 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile
Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion
Subjects
2017-04-17 14:43:41,895 - DEBUG
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:215] -
Applying policy to NameIDPolicy with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2017-04-17 14:43:41,896 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:316] - Profile
Action AddNameIDToSubjects: Request specified NameID format:
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2017-04-17 14:43:41,896 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile
Action AddNameIDToSubjects: Trying to generate NameID with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2017-04-17 14:43:41,899 - ERROR
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile
Action AddNameIDToSubjects: Error while generating NameID
org.opensaml.saml.common.SAMLException: Invalid
NameIdentifierGenerationService configuration
        at
net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)
2017-04-17 14:43:41,899 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile
Action AddNameIDToSubjects: Request specified use of an unsupportable
identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2017-04-17 14:43:41,900 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: InvalidNameIDPolicy
2017-04-17 14:43:41,900 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] -
Error event InvalidNameIDPolicy will be handled with response
2017-04-17 14:43:41,901 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:217] -
Profile Action AddStatusResponseShell: Setting Issuer to
https://209.129.116.15/idp/shibboleth
2017-04-17 14:43:41,902 - DEBUG
[org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:110] -
Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to
outgoing Response
2017-04-17 14:43:41,905 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:195] - Profile
Action AddStatusToResponse: Detailed errors are disabled
2017-04-17 14:43:41,906 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:224] - Profile
Action AddStatusToResponse: Setting StatusMessage to defaulted value
2017-04-17 14:43:41,908 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:159] - Profile
Action WebFlowMessageHandlerAdaptor: Invoking message handler of type
'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND
message context
2017-04-17 14:43:41,908 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile
Action WebFlowMessageHandlerAdaptor: Invoking message handler on message
context containing a message of type
'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2017-04-17 14:43:41,909 - DEBUG
[org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] -
Adding destination to outbound SAML 2 protocol message:
https://login.microsoftonline.com/login.srf
2017-04-17 14:43:41,909 - DEBUG
[org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52]
- Message Handler:  Checking outbound endpoint for allowed URL scheme:
https://login.microsoftonline.com/login.srf
2017-04-17 14:43:41,909 - DEBUG
[org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler:85]
- Message Handler:  Message context did not contain signing parameters,
outbound message will not be signed
2017-04-17 14:43:41,910 - DEBUG
[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]
- Looking up message encoder based on binding URI:
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2017-04-17 14:43:41,910 - DEBUG
[org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:159] -
Invoking Velocity template to create POST body
2017-04-17 14:43:41,911 - DEBUG
[org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:192] -
Encoding action url of 'https://login.microsoftonline.com/login.srf' with
encoded value
'https&#x3a;&#x2f;&#x2f;login.microsoftonline.com&#x2f;login.srf'
2017-04-17 14:43:41,911 - DEBUG
[org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:198] -
Marshalling and Base64 encoding SAML message
2017-04-17 14:43:41,912 - WARN
[org.opensaml.saml.common.binding.SAMLBindingSupport:91] - Relay state
exceeds 80 bytes, some peers may not support this.
2017-04-17 14:43:41,913 - DEBUG
[org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:220] -
Setting RelayState parameter to:
'estsredirect=2&estsrequest=rQIIAeNisFLOKCkpKLbS1y_ILypJzNHLT0vLTE7VS87P1csvSs9MAbGKhLgEPL2d15R9-ey6uq9kSrLS6-2rGNVw6tTPScxLycxL10ssLqi4wMjYxcRiaGBsvImJ1dfZ18nzBNOEs3K3mAT9i9I9U8KL3VJTUosSSzLz8w6wbAi5wCLwioXHgNmKg4NNgFmCQYHhBwvjIlagC_IzJFwK1ma5z2GfscGRl4nhFKu-kZFfoE9eoam-SUagmYWvUaprVnFySZajR0FEkEe-b46vc2WmaZVpWWFFsq2JleEENqEJbEy7OG2Jc7l9SWJRemqJrapRWkpqWmJpTglYGAA1',
encoded as
'estsredirect&#x3d;2&estsrequest&#x3d;rQIIAeNisFLOKCkpKLbS1y_ILypJzNHLT0vLTE7VS87P1csvSs9MAbGKhLgEPL2d15R9-ey6uq9kSrLS6-2rGNVw6tTPScxLycxL10ssLqi4wMjYxcRiaGBsvImJ1dfZ18nzBNOEs3K3mAT9i9I9U8KL3VJTUosSSzLz8w6wbAi5wCLwioXHgNmKg4NNgFmCQYHhBwvjIlagC_IzJFwK1ma5z2GfscGRl4nhFKu-kZFfoE9eoam-SUagmYWvUaprVnFySZajR0FEkEe-b46vc2WmaZVpWWFFsq2JleEENqEJbEy7OG2Jc7l9SWJRemqJrapRWkpqWmJpTglYGAA1'
2017-04-17 14:43:41,915 - DEBUG
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action
RecordResponseComplete: Record response complete
2017-04-17 14:43:41,916 - INFO [Shibboleth-Audit.SSO:241] -
20170417T214341Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fe396630-fdd6-4756-b6cf-25eb86397304|urn:federation:MicrosoftOnline|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://209.129.116.15/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2d61b66ccaa88c42e801cefcd1f66c8b|marc.test||UserId,AzureGUID|||

saml-nameid.xml:

        <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
            p:attributeSourceIds="#{ {'AzureGUID'} }">
            <property name="activationCondition">
                <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidates="urn:federation:MicrosoftOnline" />
            </property>
        </bean>

relaying-party.xml:
    <bean parent="RelyingPartyByName"
c:relyingPartyIds="urn:federation:MicrosoftOnline">
        <property name="profileConfigurations">
            <list>
                <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
/>
            </list>
        </property>
    </bean>

Thank you for your time!

--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Error-while-generating-NameID-for-Office365-tp7632666.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.