Nameid unspecified with Legacy Relying party

Tue Mar 21 12:21:11 EDT 2017

I added nameidformatprecedence to relyingparty and receiving the below error. There is no beans in saml-id.properties as I am using legacy file. I have my configuration below. Any kind of help is appreciated.
2017-03-21 12:05:52,626 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2017-03-21 12:05:52,631 - ERROR [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:404] - Profile Action AddNameIDToSubjects: Error while generating NameID
org.opensaml.saml.common.SAMLException: Invalid NameIdentifierGenerationService configuration
        at net.shibboleth.idp.saml.nameid.impl.ProxySAML2NameIDGenerator.generate(ProxySAML2NameIDGenerator.java:62)
2017-03-21 12:05:52,631 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty

In metadata.xml,
 <EntityDescriptor entityID="https://fmweb-prod.mdc.musc.edu/FMInteract" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
                <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
                <AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://fmweb-prod.mdc.musc.edu/FMInteract/ConsumerService2.aspx"/>
                </SPSSODescriptor>
        </EntityDescriptor>

In attribute-resolver.xml,
 <resolver:AttributeDefinition id="FMNameId" xsi:type="ad:Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="sAMAccountName"> <resolver:Dependency ref="myAD" />
 <resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
    </resolver:AttributeDefinition>

In attribute-filter.xml,
    <afp:AttributeFilterPolicy id="releaseToFmSystems">
        <afp:PolicyRequirementRule xsi:type="basic:OR">
            <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://fmweb-test.mdc.musc.edu/FMInteract_TST"/>
            <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://fmweb-prod.mdc.musc.edu/FMInteract"/>
        </afp:PolicyRequirementRule>

         <afp:AttributeRule attributeID="FMNameId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

In relying-party.xml (added the nameidformatprecedence),
<rp:RelyingParty id="https://fmweb-prod.mdc.musc.edu/FMInteract"
                provider="https://shibboleth.musc.edu/shibboleth-idp"
                defaultSigningCredentialRef="musc_creds"
                 nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">
        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
                signResponses="never"
                signAssertions="always"
                encryptNameIds="never"
                encryptAssertions="never" />
        <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
                signResponses="never"
                signAssertions="always"
                encryptNameIds="never"
                encryptAssertions="never" />
        <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
                signResponses="never"
                signAssertions="always"
                encryptNameIds="never"
                encryptAssertions="never" />
      </rp:RelyingParty>

In saml-nameid.properties (to use legacy files),
idp.nameid.saml2.legacyGenerator= shibboleth.LegacySAML2NameIDGenerator
idp.nameid.saml1.legacyGenerator= shibboleth.LegacySAML1NameIdentifierGenerator

In saml-nameid.xml,
    <util:list id="shibboleth.SAML2NameIDGenerators">
      <ref bean="shibboleth.SAML2TransientGenerator" />
<!--
      <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
            p:attributeSourceIds="#{ {'QbNameId'} }" />
-->
    </util:list>

     <util:list id="shibboleth.SAML1NameIdentifierGenerators">
        <ref bean="shibboleth.SAML1TransientGenerator" />
        <!--
        <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
            p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
            p:attributeSourceIds="#{ {'mail'} }" />
        -->
    </util:list>

In services.properties,
idp.service.relyingparty.resources= shibboleth.LegacyRelyingPartyResolverResources
#idp.service.relyingparty.failFast = false

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, March 20, 2017 8:13 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Nameid unspecified with Legacy Relying party

On 3/20/17, 7:38 PM, "users on behalf of Ramaiah, Vanna G." <users-bounces at shibboleth.net on behalf of ramaiah at musc.edu> wrote:

>I upgraded from v2.4 to v3.3. Everything seems to be working fine except for “unspecified” nameids.

Then your old configuration was broken to start with.

> How to solve the nameids unspeficied problem.

The chances are you don't need them. If you actually do (you don't), then you configure them properly, by setting the nameIDFormatPrecedence property in the relevant profile configuration. Same as before. Follow the V2 documentation if you're using the legacy format.

> While I contact the SPs to change the nameids format specified, I am afraid that cannot happen soon.

Just stop using them and the SP will most likely not even notice.

> Here is relying-party sample.

It doesn't include the nameIDFormatPrecedence setting. There is no other way to correctly select that Format, so your old file was broken, and that's why the upgrade failed.

https://wiki.shibboleth.net/confluence/display/IDP30/UpgradingFromV2

The documentation explicitly calls this out.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net