v3.2 - unsupportable identifier -Name ID

[IAM David Bantz]

If I interpret correctly you took a relying party config and pasted it into
the resolver.
Don't do that.

Treat the release of nameid with nameid-format:unspecified exactly as you
did the one with nameid-format:emailAddress

In fact it appears these have exactly the same values, so you only need one
SAML attribute from the resolver, used as the source for nameids in either
'unspecified' or emalAddress format for different SPs.  No need to resolve
the same value into two different SAML attributes.

David Bantz
UA OIT IAM


On Wed, Feb 22, 2017 at 1:19 PM, Ramaiah, Vanna G. <ramaiah at musc.edu> wrote:

> This  is the error I get.  I commented out the relying party config of SP
> xyz from v2 and added this below code. Should this be placed in other bean?
> <bean parent="RelyingPartyByName"
>               c:relyingPartyIds="#{{XYZ'}}">
>
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO.custom"
> p:signAssertions="true" p:encryptAssertions="false"
> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> />
>                 </list>
>             </property>
>         </bean>
> 2017-02-22 17:11:39,181 - ERROR [net.shibboleth.utilities.
> java.support.service.AbstractReloadableService:181] - Service 'shibboleth.RelyingPartyResolverService':
> Initial load failed
> net.shibboleth.utilities.java.support.service.ServiceException:
> org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException:
> Line 298 in XML document from file [/opt/shibboleth-idp/conf/relying-party.xml]
> is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber:
> 298; columnNumber: 85; The prefix "c" for attribute "c:relyingPartyIds"
> associated with an element type "bean" is not bound.
>
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
> Scott
> Sent: Wednesday, February 22, 2017 4:48 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: v3.2 - unsupportable identifier -Name ID
>
>
>
> On 2/22/17, 4:31 PM, "users on behalf of Ramaiah, Vanna G." <
> users-bounces at shibboleth.net on behalf of ramaiah at musc.edu> wrote:
>
> > 3.In metadata of xyz,
> >  <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-
> format:unspecified</md:NameIDFormat>
>
> The documentation tells you explicitly that that doesn't work.
>
> > 4. I copy pasted the relying-party.xml from V2.4 to V3.2. where should
> the below segment go?
>
> I can't tell you how to structure your relying party rules, but the
> settings are fine.
>
> > 5. Should I add anything to saml-nameid.xml?
>
> The same thing you would add for any custom format. There is no difference
> here except for the fact that you can't trigger it with metadata.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170222/a4e80f6e/attachment.html>