Aw: Re: your mail

[Ilya Rumyantsev]

Hi Peter, thanks. I indeed have the eduPersonTargetedId defined:

<AttributeDefinition
     id="eduPersonTargetedID"
     xsi:type="Simple"
     sourceAttributeID="computedID">
   <Dependency ref="computedIDDC" />
	
        <AttributeEncoder
	    xsi:type="SAML1XMLObject"
            name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
	
        <AttributeEncoder xsi:type="SAML2XMLObject" 
			  name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
 </AttributeDefinition>

INFO [Shibboleth-Audit.SSO:241] - 20181008T122354Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_c462d14648b3195fedd8b75e3432d2b956b3491e95|https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php[0/1165]-sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp.fraunhofer.de/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_222a9e0b958649b55013fe3e9e84732f|Ilya Rumyantsev|urn:oasis:names:tc:SAML:2.0:ac:classes:X509|eduPersonEntitlement,transientId,eduPersonScopedAffiliation,eduPersonTargetedID,displayName,givenName,eduPersonPrincipalName,sn,email,organizationalUnit|AAdzZWNyZXQxrIA3FjT0UEHsvFBO9uyLKlTZvvLk2RdeKSMAw4Uq7gYDwGxK07YQP+ErWepyxlJDrE4O4o1RLj5Gyqqsf65Gh7Rcrp8a8R+GoZK94+6a0INEEy5u3XrA3E87YjxD3XQyuiIU5i31RTb9g2IFIKo8376bxcMrYbCpklA0D1BAPKv/PbzhQImDLjeeZuVWaA==|_a7476101da051863f334239452950274|

According to logs it might be because of the encoding then:

Profile Action AddAttributeStatementToAssertion: Attribute eduPersonTargetedID did not have a usable SAML 2 Attribute enco
der associated with it, nothing to do

It is right according to this dfn wiki:

    https://wiki.aai.dfn.de/de:shibidp3attributes-targetedid

Do you have any ideas on that?

Thanks a lot

> Gesendet: Montag, 08. Oktober 2018 um 13:44 Uhr
> Von: "Peter Schober" <peter.schober at univie.ac.at>
> An: users at shibboleth.net
> Betreff: Re: your mail
>
> * Ilya Rumyantsev <iliggio at gmx.de> [2018-10-08 13:31]:
> > Hi all, from a service provider I am getting the following error message:
> > 
> >     SimpleSAML_Error_Exception: This service needs at least one of the following
> > 		attributes to identity users: eduPersonTargetedID, facebook_targetedID, google_eppn, linkedin_targetedID, twitter_targetedID. Unfortunately not
> > 		one of them was detected. Please ask your institution administrator to release one of
> > 		them, or try using another identity provider.
> > 
> > I have the following settings in saml-nameid.properties
> 
> The error message above says nothing about your NameID format being
> wrong, it says the SP expects one of these *attributes* to be present.
> 
> The only SAML attribute in there is eduPersonTargetedID (the rest is
> stuff SimpleSAMLphp made up internally), which should be deprecated by
> now.
> Anyway: While the attribute value of the eduPersonTargetedID attribute
> is a persistent SAML NameID you cannot create such an
> eduPersonTargetedID attribute from within the saml-nameid.* files
> alone. So nothing you do in these files has anything to do with the
> error above. (Take that into account when reading further comments below.)
> 
> > idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
> > idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier
> 
> There's no need to uncomment these as those match the distributed
> defaults.
> 
> > idp.persistentId.sourceAttribute = eduPersonTargetedID
> 
> Do you actually have an attribute defined in your
> attribute-resolver.xml with an id="eduPersonTargetedID"?
> If so I'd personally set idp.persistentId.sourceAttribute to the same
> source attribute you base the generation of eduPersonTargetedID on.
> I.e., if X was your stable internal identifier you'd use X as
> sourceAttribute for persistsent NameIDs as well as the
> sourceAttributeID for the DataConnector you're creating the
> eduPersonTargetedID attribute with, in your resolver.
> 
> > If I look into my assertion, I see 
> > 
> >     <saml2:NameID
> >        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
> > 
> > Which I don't understand as I have set it to persistent as default value.
> 
> Again, this has nothing to do with the error message you're getting
> (which is about a missing attribute, not about the NameID format in
> the Subject of the SAML Assertion), but the logic for NameID format
> selection is here:
> https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration#NameIDGenerationConfiguration-FormatSelectionFormatSelection
> 
> Of course the format selection logic is only relevant if your
> configuration is correct in every other regard. Otherwise it would
> just fall through to transient, anyway.
> 
> -peter
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>