Persistent NameID generation

[Boyd, Todd M.]

I’ve been wracking my brain with this over the last several days (not including the weekend, thankfully). I’m trying to get Shib IDP to generate a persistent NameID using our campusPermanentId attribute, but I’m seeing this in the logs:

2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion Subjects
2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:218] - Policy checking disabled for NameIDPolicy with Format urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatStrategy:82] - Metadata specifies the following formats: [urn:oasis:names:tc:SAML:2.0:nameid‑format:persistent]
2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:323] - Profile Action AddNameIDToSubjects: Candidate NameID formats: [urn:oasis:names:tc:SAML:2.0:nameid‑format:persistent]
2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile Action AddNameIDToSubjects: Trying to generate NameID with Format urn:oasis:names:tc:SAML:2.0:nameid‑format:persistent
2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106] - Trying to generate identifier with Format urn:oasis:names:tc:SAML:2.0:nameid‑format:persistent
2018-04-30 12:46:47,115 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:341] - Profile Action AddNameIDToSubjects: Unable to generate a NameID, leaving empty

There are no errors in the idp-process.log file, so as far as I can tell, it’s not having any issues with the configuration. I uncommented the SAML2PersistentGenerator bean in saml-nameid.xml, and I’ve set the following values in saml-nameid.properties:

idp.persistentId.sourceAttribute = campusPermanentId
idp.persistentId.salt = (some salt value here)

The rest of the file is commented out, relying on defaults, though I’ve tried tweaking those settings to be explicit, as well—such as releasing the attribute to this SP and using filtered attributes as well as specifying the encodedSalt value.

We release the campusPermanentId attribute to other SPs (and I’ve experimented by releasing the attribute to this particular SP), so I know the attribute is being retrieved and that it does have a value. I’m rather confused as to what could be the problem. Any suggestions on where else I could check to troubleshoot further?


-Todd
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180430/9cdd6946/attachment.html>