[Nate Klingenstein]

Ilya,

 
Sending eduPersonTargetedID as a persistent name identifier is quite different from sending it in an attribute.  I suspect you will have to send it in attribute form or submit a PR to simpleSAMLphp(and note that both of these are not preferred to the new OASIS pairwise-id, so if they really want to modernize in 2.0, it may be a good addition).  The examples were yanked from the 3.3.3 distribution, so you'd need to figure out how to construct it based on documentation or older releases.

 
 
I have no idea why you're churning out targetedId's instead, but if you turn the logging to DEBUG for the IdP, you'll see the exact selection logic followed and will be able to determine why.

 
 
Hope this helps,

Nate.

-----Original message-----
From: Ilya Rumyantsev
Sent: Monday, October 8 2018, 5:31 am
To: users at shibboleth.net
Subject:
 
Hi all, from a service provider I am getting the following error message:

    SimpleSAML_Error_Exception: This service needs at least one of the following
		attributes to identity users: eduPersonTargetedID, facebook_targetedID, google_eppn, linkedin_targetedID, twitter_targetedID. Unfortunately not
		one of them was detected. Please ask your institution administrator to release one of
		them, or try using another identity provider.

I have the following settings in saml-nameid.properties

     idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
     idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier

     idp.transientId.generator = shibboleth.CryptoTransientIdGenerator

     idp.persistentId.sourceAttribute = eduPersonTargetedID


the `shibboleth.SAML2PersistentGenerator` bean is uncommented in saml-nameid.xml and the attribute filter is set to release this attribute.

If I look into my assertion, I see 

    <saml2:NameID
       Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"

Which I don't understand as I have set it to persistent as default value.

What am I missing?
Thanks a lot
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net> 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181008/59481cf6/attachment.html>