your mail

[Peter Schober]

* Ilya Rumyantsev <iliggio at gmx.de> [2018-10-08 13:31]:
> Hi all, from a service provider I am getting the following error message:
> 
>     SimpleSAML_Error_Exception: This service needs at least one of the following
> 		attributes to identity users: eduPersonTargetedID, facebook_targetedID, google_eppn, linkedin_targetedID, twitter_targetedID. Unfortunately not
> 		one of them was detected. Please ask your institution administrator to release one of
> 		them, or try using another identity provider.
> 
> I have the following settings in saml-nameid.properties

The error message above says nothing about your NameID format being
wrong, it says the SP expects one of these *attributes* to be present.

The only SAML attribute in there is eduPersonTargetedID (the rest is
stuff SimpleSAMLphp made up internally), which should be deprecated by
now.
Anyway: While the attribute value of the eduPersonTargetedID attribute
is a persistent SAML NameID you cannot create such an
eduPersonTargetedID attribute from within the saml-nameid.* files
alone. So nothing you do in these files has anything to do with the
error above. (Take that into account when reading further comments below.)

> idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
> idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier

There's no need to uncomment these as those match the distributed
defaults.

> idp.persistentId.sourceAttribute = eduPersonTargetedID

Do you actually have an attribute defined in your
attribute-resolver.xml with an id="eduPersonTargetedID"?
If so I'd personally set idp.persistentId.sourceAttribute to the same
source attribute you base the generation of eduPersonTargetedID on.
I.e., if X was your stable internal identifier you'd use X as
sourceAttribute for persistsent NameIDs as well as the
sourceAttributeID for the DataConnector you're creating the
eduPersonTargetedID attribute with, in your resolver.

> If I look into my assertion, I see 
> 
>     <saml2:NameID
>        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
> 
> Which I don't understand as I have set it to persistent as default value.

Again, this has nothing to do with the error message you're getting
(which is about a missing attribute, not about the NameID format in
the Subject of the SAML Assertion), but the logic for NameID format
selection is here:
https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration#NameIDGenerationConfiguration-FormatSelectionFormatSelection

Of course the format selection logic is only relevant if your
configuration is correct in every other regard. Otherwise it would
just fall through to transient, anyway.

-peter