IDP 2.4.0

[Rhian Resnick]

Afternoon,


I have an old 2.4.0 IDP (about to be upgraded) that releases saml subjects in the following format (notice the lack of an @site.edu in the subject. Our 3.x IDP is working fine but the production system is still 2.4.0 and refuses to add the @site.edu to the subject.


I double checked the attribute resolver file and confirmed that all instances of the emailAddress nameid format are scoped.


      <saml2:Subject>
         <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="https://sso.fau.edu/idp/shibboleth" SPNameQualifier="http://www.webex.com/faulearn">rresnick</saml2:NameID>
         <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml2:SubjectConfirmationData Address="10.16.173.10" InResponseTo="s2cf9cd2826bd0add88b95af9e536b06579d7707aa" NotOnOrAfter="2017-04-18T18:19:19.472Z" Recipient="https://faulearning.webex.com/dispatcher/SAML2AuthService?siteurl=faulearning"/>
         </saml2:SubjectConfirmation>
      </saml2:Subject>

The eduPersonPrincibleName which is meant to be sent as the subject is scoped.

         <saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">rresnick at fau.edu</saml2:AttributeValue>
         </saml2:Attribute>


And the log line indicates that eduPersonPrincible name is the only nameid that is of the emailaddress format being returned (log lines confirms the incorrect subject.)

14:14:21.321 - INFO [Shibboleth-Audit:1028] - [10.16.173.10] - 20170418T181421Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|s2cf9cd2826bd0add88b95af9e536b06579d7707aa|http://www.webex.com/faulearn|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://sso.fau.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_0b1459d95aa19575bfd66f19199a8948|rresnick|urn:oasis:names:tc:SAML:2.0:ac:classes:Password|eduPersonPrincipalName,surname,givenName,eduPersonEntitlement,transientId,eduPersonTargetedID,email,|rresnick|_776a2d6d721a45215051df6986da9dd3,|


Any thoughts on what could be going on or which file to check out.




Rhian Resnick

Assistant Director Middleware and HPC

Office of Information Technology


Florida Atlantic University

777 Glades Road, CM22, Rm 173B

Boca Raton, FL 33431

Phone 561.297.2647

Fax 561.297.0222

 [image] <https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170418/4637824a/attachment-0001.html>