v3.2 - unsupportable identifier -Name ID

[Ramaiah, Vanna G.]

No. I took relying party from V2.4 and pasted in V3.2. So, headers of relying-party.xml are different. Release of nameid-emailaddress was exactly the release of nameid-unspecified.
As Scott mentioned, unspecified nameID should not in the metadata?
I read the document https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22 but not sure where would I put those codes in. I just placed the code in relying-party.xml
<bean parent="RelyingPartyByName"
              c:relyingPartyIds="#{{XYZ'}}">

            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.custom" p:signAssertions="true" p:encryptAssertions="false"  p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
                </list>
            </property>
        </bean>


Tomcat restart is throwing error on incorrect relying-party.xml load.
2017-02-22 17:11:39,181 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.RelyingPartyResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 298 in XML document from file [/opt/shibboleth-idp/conf/relying-party.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 298; columnNumber: 85; The prefix "c" for attribute "c:relyingPartyIds" associated with an element type "bean" is not bound.
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of IAM David Bantz
Sent: Wednesday, February 22, 2017 6:00 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: v3.2 - unsupportable identifier -Name ID



If I interpret correctly you took a relying party config and pasted it into the resolver.
Don't do that.

Treat the release of nameid with nameid-format:unspecified exactly as you did the one with nameid-format:emailAddress

In fact it appears these have exactly the same values, so you only need one SAML attribute from the resolver, used as the source for nameids in either 'unspecified' or emalAddress format for different SPs.  No need to resolve the same value into two different SAML attributes.

David Bantz
UA OIT IAM


On Wed, Feb 22, 2017 at 1:19 PM, Ramaiah, Vanna G. <ramaiah at musc.edu<mailto:ramaiah at musc.edu>> wrote:
This  is the error I get.  I commented out the relying party config of SP xyz from v2 and added this below code. Should this be placed in other bean?
<bean parent="RelyingPartyByName"
              c:relyingPartyIds="#{{XYZ'}}">

            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.custom" p:signAssertions="true" p:encryptAssertions="false"  p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
                </list>
            </property>
        </bean>
2017-02-22 17:11:39,181 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.RelyingPartyResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 298 in XML document from file [/opt/shibboleth-idp/conf/relying-party.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 298; columnNumber: 85; The prefix "c" for attribute "c:relyingPartyIds" associated with an element type "bean" is not bound.


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>] On Behalf Of Cantor, Scott
Sent: Wednesday, February 22, 2017 4:48 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: v3.2 - unsupportable identifier -Name ID


On 2/22/17, 4:31 PM, "users on behalf of Ramaiah, Vanna G." <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of ramaiah at musc.edu<mailto:ramaiah at musc.edu>> wrote:

> 3.In metadata of xyz,
>  <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>

The documentation tells you explicitly that that doesn't work.

> 4. I copy pasted the relying-party.xml from V2.4 to V3.2. where should the below segment go?

I can't tell you how to structure your relying party rules, but the settings are fine.

> 5. Should I add anything to saml-nameid.xml?

The same thing you would add for any custom format. There is no difference here except for the fact that you can't trigger it with metadata.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>





--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170222/16c0abfd/attachment-0001.html>