v3.2 - unsupportable identifier -Name ID

[Ramaiah, Vanna G.]

In attribute resolver, I have this name ID encoder (samaccountname passed as unspecified NameID).
<resolver:AttributeDefinition id="FMNameId" xsi:type="ad:Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="sAMAccountName"> <resolver:Dependency ref="myAD" />
   <resolver:AttributeEncoder xsi:type="SAML2StringNameID"   xmlns="urn:mace:shibboleth:2.0:attribute:encoder"         nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />  </resolver:AttributeDefinition>

I uncommented the legacy idp.nameid.saml2.legacyGenerator and idp.nameid.saml1.legacyGenerator in saml-naemid.properties file.
After logging in, one of the SP's keep looping again and again.
DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2017-02-21 11:08:32,722 - WARN [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:75] - Ignoring NameIDFormat metadata that includes the 'unspecified' format
DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:2.0:nameid-format:transient]

 Other SP , after logging in, if I click a link, it's supposed to display all attributes passed by Idp. It's not showing up. Both the SP's both work fine in V2.4




-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, February 21, 2017 10:26 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: v3.2 - unsupportable identifier -Name ID



> There was no upgrade. It was fresh installation of V3.2.

That's why it broke.

> Commenting out
> idp.nameid.saml2.legacyGenerator helped the NameID specified.

You don't comment it out, you uncomment it and leave it enabled if you want it to leverage the old NameID encoders in the resolver, at which point it should work like it did before. Any problems at that point are related to the selection of the desired Format, which is documented in the wiki. That hasn't really changed from V2, but people have historically not done it correctly in many cases and are having problems with accidentally working systems no longer working because they weren't configured properly to begin with.

> I am still getting errors for NameID unspecified ones. Any idea?

You haven't described any error yet.

There are virtually no SPs that require that format anyway, when they claim to, they are almost always not checking it, which is fairly logical given that it means nothing.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net