Shibboleth eduPersonTargetedID issue

[excised at request of author]

Hi all,

We are deploying Shibboleth IdP and SP on our institution, everything is working as expected with the exception of generating, storing and releasing the eduPersonTargetedID attribute.
The persistent ID will be mapped off the sAMAccountName in AD.

Our environment is based on a Shibboleth IdP 3.3/Jetty 9.3/CentOS 7.2 and it was installed following the steps in https://spaces.internet2.edu/pages/viewpage.action?pageId=49841792

The specific configuration performed in order to get the persistent ID working is the following:

/opt/shibboleth-idp/conf/saml-nameid.xml:

<ref bean="shibboleth.SAML2PersistentGenerator" />
<!-- A DataSource bean suitable for use in the idp.persistentId.dataSource property. -->
<bean id="PersistentIdStore"
    class="org.apache.commons.dbcp2.BasicDataSource"
    p:driverClassName="org.postgresql.Driver"
    p:url="jdbc:postgresql://127.0.0.1:5432/shibboleth"
    p:username="shibboleth"
    p:password="ourpass"
    p:maxIdle="5"
    p:maxWaitMillis="15000"
    p:testOnBorrow="true"
    p:validationQuery="select 1"
    p:validationQueryTimeout="5" />

<!-- A "store" bean suitable for use in the idp.persistentId.store property. -->
<bean id="MyPersistentIdStore" parent="shibboleth.JDBCPersistentIdStore"
    p:dataSource-ref="PersistentIdStore"
    p:queryTimeout="PT2S"
    p:retryableErrors="#{{'23000'}}" />
</beans>

/opt/shibboleth-idp/conf/saml-nameid.properties:

idp.transientId.generator = shibboleth.StoredTransientIdGenerator
idp.persistentId.generator = shibboleth.StoredPersistentIdGenerator
idp.persistentId.dataSource = PersistentIdDataSource
idp.persistentId.sourceAttribute = sAMAccountName
idp.persistentId.salt = oursalt
idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator
idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
idp.persistentId.algorithm = SHA
idp.persistentId.useUnfilteredAttributes = true

/opt/shibboleth-idp/conf/c14n/subject-c14n.xml:

<ref bean="c14n/SAML2Persistent" />

The PostgreSQL DB was created as below:
sudo -iu postgres psql <<EOF
CREATE ROLE shibboleth WITH LOGIN;
CREATE DATABASE shibboleth WITH OWNER shibboleth ENCODING 'UTF8' TEMPLATE template0;
\c shibboleth
SET ROLE shibboleth;
CREATE TABLE shibpid (
    localEntity VARCHAR(1024) NOT NULL,
    peerEntity VARCHAR(1024) NOT NULL,
    principalName VARCHAR(255) NOT NULL,
    localId VARCHAR(255) NOT NULL,
    persistentId VARCHAR(36) NOT NULL,
    peerProvidedId VARCHAR(255) NULL,
    creationDate TIMESTAMP NOT NULL DEFAULT LOCALTIMESTAMP,
    deactivationDate TIMESTAMP NULL DEFAULT NULL,
    PRIMARY KEY (localEntity, peerEntity, persistentId)
);
CREATE INDEX shibpid_getbysourcevalue_index ON shibpid(localEntity, peerEntity, localId, deactivationDate);
CREATE TABLE storagerecords (
    context VARCHAR(255) NOT NULL,
    id VARCHAR(255) NOT NULL,
    expires BIGINT DEFAULT NULL,
    value TEXT NOT NULL,
    version BIGINT NOT NULL,
    PRIMARY KEY (context, id)
);
CREATE INDEX storagerecords_expires_index ON storagerecords(expires);
EOF

The /var/lib/pgsql/data/pg_hba.conf was changed from ident to md5.

The DBCP2 was downloaded from http://www-us.apache.org/dist//commons/dbcp/binaries/commons-dbcp2-2.1.1-bin.zip<http://www-us.apache.org/dist/commons/dbcp/binaries/commons-dbcp2-2.1.1-bin.zip> and placed on /opt/shibboleth-idp/edit-webapp/WEB-INF/lib and a /bin/build.sh was performed.

On the /idp/status page we get the following error:



service: shibboleth.NameIdentifierGenerationService

last reload attempt: 2017-03-14T09:07:59Z

last failure cause: net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2NameIDGenerators': Cannot resolve reference to bean 'shibboleth.SAML2PersistentGenerator' while setting bean property 'sourceList' with key [1]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.SAML2PersistentGenerator' defined in file [/opt/shibboleth-idp/system/conf/saml-nameid-system.xml]: Cannot resolve reference to bean '#{'shibboleth.StoredPersistentIdGenerator'.trim()}' while setting bean property 'persistentIdGenerator'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.StoredPersistentIdGenerator' defined in file [/opt/shibboleth-idp/system/conf/saml-nameid-system.xml]: Initialization of bean failed; nested exception is org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'MyPersistentIdStore' defined in file [/opt/shibboleth-idp/conf/saml-nameid.xml]: Cannot resolve reference to bean 'PersistentIdStore' while setting bean property 'dataSource'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'PersistentIdStore' defined in file [/opt/shibboleth-idp/conf/saml-nameid.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apache.commons.dbcp2.BasicDataSource]: No default constructor found; nested exception is java.lang.NoClassDefFoundError: org/apache/commons/pool2/PooledObjectFactory

Kind Regards,

excised at request of author
IT Systems Administrator

Wellington Building
Griffith College
South Circular Road, Dublin 8, Ireland

Phone:  + 353 1 416 3365
Website: http://www.griffith.ie

Disclaimer:
This E-mail is from Griffith College Dublin.
The E-mail and any files transmitted with it are confidential and may be privileged and are intended solely for the use of the individual or entity to whom they are addressed.
If you are not the addressee you are prohibited from disclosing its content, copying it or distributing it otherwise than to the addressee. If you have received this e-mail in error,
please immediately notify the sender by replying to this e-mail and delete the e-mail from your computer. Griffith College is a trading name of Bellerophon Ltd,
(registered in Ireland No. 60469) with its registered address as Griffith College Campus,South Circular Road, Dublin 8, Ireland.


P Think before you print!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170314/66eec3ba/attachment-0001.html>