SAML2 NameID in Subject

[Craig Pluchinsky]

Do you have an attribute filter set up to release that attribute to the 
adobe entityID?


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Tue, 18 Jul 2017, Vonblohn, Kyle wrote:

> Thanks Andy, but I've tried all of that.  Here are snippets of my files:
>
> relying-party.xml:
>
> <!-- ===== -->
> <!-- Adobe -->
> <!-- ===== -->
>
> <bean parent="RelyingPartyByName" c:relyingPartyIds="https://www.okta.com/saml2/service-provider/spienv8o80qZUv17G0x7">
>    <property name="profileConfigurations">
>        <list>
>            <bean parent="SAML2.SSO" p:includeAttributeStatement="true" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" p:signAssertions="true" p:encryptAssertions="false" p:encryptNameIDs="false"/>
>            <bean parent="SAML2.Logout" p:signResponses="false"/>
>        </list>
>    </property>
> </bean>
>
> saml-nameid.xml:
>
> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>     p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>     p:attributeSourceIds="#{ {'Email'} }">
>   <property name="activationCondition">
>       <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{{'https://www.okta.com/saml2/service-provider/spienv8o80qZUv17G0x7'}}" />
>   </property>
> </bean>
>
> And attribute-resolver.xml
>
>    <!-- ===== -->
>    <!-- Adobe -->
>    <!-- ===== -->
>
>    <resolver:AttributeDefinition id="FirstName" xsi:type="ad:Simple" sourceAttributeID="givenName">
>        <resolver:Dependency ref="BUAD" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" />
>    </resolver:AttributeDefinition>
>    <resolver:AttributeDefinition id="LastName" xsi:type="ad:Simple" sourceAttributeID="sn">
>        <resolver:Dependency ref="BUAD" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" />
>    </resolver:AttributeDefinition>
>    <resolver:AttributeDefinition id="Email" xsi:type="ad:Simple" sourceAttributeID="mail">
>        <resolver:Dependency ref="BUAD" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
>    </resolver:AttributeDefinition>
>
>
> I know I'm missing something, but for the life of me, I can't figure out what it is.  I've been working on this since last week, and have done multiple searches for information.
>
> This is the subject of my saml response:
>
>       <saml2:Subject>
>            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
>                <saml2:SubjectConfirmationData Address="148.137.##.##"
>                                               InResponseTo="id448028774800135631139003950"
>                                               NotOnOrAfter="2017-07-18T18:53:58.618Z"
>                                               Recipient="https://adbe-bloomu-d-edu-b749-prd.okta.com/auth/saml20/accauthlinktest"
>                                               />
>            </saml2:SubjectConfirmation>
>        </saml2:Subject>
>
> As you can see, the NameID portion is completely missing.  I'm at a loss.
>
> Thanks,
> Kyle
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Andrew Morgan
> Sent: Tuesday, July 18, 2017 2:43 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: SAML2 NameID in Subject
>
> On Tue, 18 Jul 2017, Vonblohn, Kyle wrote:
>
>> I am trying to setup adobe sso with IDPv3.  The documentation says
>> they need the NameID in the saml subject.  I can't seem to find any
>> documentation about where that is configured.  I've run a saml trace
>> in firefox and confirmed the entire NameID section is missing from the
>> subject.  If someone could point me in the right direction, I would be
>> appreciative.
>
> Kyle,
>
> Start with these:
>
>   https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_IDP30_NameIDGenerationConfiguration&d=DwICAg&c=HS1CjnFyfzCL6mp0nkGYYw&r=ZgELPkjogmqCnk2rHf8e-cNQsyTdR1whj_eOZqt-EEs&m=Ltn_COR1mc84j2Q7WIEL7IjLgbOYHpMNPopjvsN2-J0&s=_nTXbQ2nT-KGBXss74W-ww9GsHNxMVWHvmuwu8EPY6E&e=
>
>   https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_IDP30_CustomNameIDGenerationConfiguration&d=DwICAg&c=HS1CjnFyfzCL6mp0nkGYYw&r=ZgELPkjogmqCnk2rHf8e-cNQsyTdR1whj_eOZqt-EEs&m=Ltn_COR1mc84j2Q7WIEL7IjLgbOYHpMNPopjvsN2-J0&s=Q5YHgdRYrGkMxZx2MHjWHglmi1naVRAOx3eRm2yVt0o&e=
>
> Based on what I see with our Adobe integration, I think you'll need to support the "emailAddress" NameID Format.  We chose to release EPPN to SPs that request emailAddress.  In saml-nameid.xml, we have:
>
>   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>       p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }">
>       <property name="activationCondition">
>           <bean parent="shibboleth.Conditions.NOT">
>               <constructor-arg>
>                   <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="google.com/a/oregonstate.edu" />
>               </constructor-arg>
>           </bean>
>       </property>
>   </bean>
>
> This example also shows how we exclude our Google instance from this particular generator.
>
> 	Andy
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>