nameID format error

[Klingenstein, Nate]

David,


I typically get that message when the IdP is trying to generate a NameID, but it's unable to do so because I'm not releasing an attribute that meets the requirements of the request.


Whether you're using actual persistentId's with other SP's, I don't know, but you'll probably need to define something in saml-nameid.xml for this if it's going to use the actual NameID signaling.


If so, then you'll want to make a NameID generation definition that is conditional on the identity of the relying party.  If not, you can do something icky in there.  Secret option #3 is not using NameID signaling at all, but instead forcibly releasing the attribute in a deprecated way, which won't be an option in v4.


It's worth noting for the peanut gallery that this isn't really what persistent NameID's should be populated with.


Hope this helps,

Nate.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of IAM David Bantz <dabantz at alaska.edu>
Sent: Monday, September 11, 2017 4:25:41 PM
To: users at shibboleth.net
Subject: nameID format error

I'm obviously missing something triggering "unsupportable identifier format", but haven't been able to spot it; pointers appreciated.

incoming request:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"...
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"...

    <saml:Issuer>https://integration.oohlalamobile.com/saml/uasitka/metadata</saml:Issuer>
    <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" AllowCreate="true" />...
</samlp:AuthnRequest>

in attribute-resolver:

<AttributeDefinition id="eduPersonUniqueID" xsi:type="Simple"
                              sourceAttributeID="uakPersonID">
    <Dependency ref="uakPersonID" />
    <AttributeEncoder xsi:type="SAML2ScopedString"
          name="urn:oid:1.3.6.1.4.1.5923.1.1.1.13" friendlyName="eduPersonUniqueID"></AttributeEncoder>
    <AttributeEncoder xsi:type="SAML2StringNameID"
           nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
</AttributeDefinition>

in attribute-filter:

<AttributeFilterPolicy id="releaseToOohLaLa">
        <PolicyRequirementRule xsi:type="Requester" value="https://integration.oohlalamobile.com/saml/uasitka/metadata" />
        <AttributeRule attributeID="eduPersonUniqueID">
                <PermitValueRule xsi:type="ANY"/>
        </AttributeRule>...

in relying-party:

        <bean parent="RelyingPartyByName"
                        c:relyingPartyIds="#{{'https://integration.oohlalamobile.com/saml/uasitka/metadata'}}">
            <property name="profileConfigurations">
               <list>
                   <bean parent="SAML2.SSO"
                         p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
               </list>
            </property>
        </bean>

in the process log:

11:39:43:908  WARN [192.252.140.146] org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337 >  Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

11:39:43:909  WARN [192.252.140.146] org.opensaml.profile.action.impl.LogEvent:105 >  A non-proceed event occurred while processing the request: InvalidNameIDPolicy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170911/12f1bba1/attachment-0001.html>