Aw: RE:

[Ilya Rumyantsev]

Thanks Nate, I will check the pairwise-id

Kind regards,
Ilya

> Gesendet: Montag, 08. Oktober 2018 um 15:25 Uhr
> Von: "Nate Klingenstein" <ndk at signet.id>
> An: "Shib Users" <users at shibboleth.net>
> Betreff: RE:
>
> Ilya,
> 
>  
> Sending eduPersonTargetedID as a persistent name identifier is quite different from sending it in an attribute.  I suspect you will have to send it in attribute form or submit a PR to simpleSAMLphp(and note that both of these are not preferred to the new OASIS pairwise-id, so if they really want to modernize in 2.0, it may be a good addition).  The examples were yanked from the 3.3.3 distribution, so you'd need to figure out how to construct it based on documentation or older releases.
> 
>  
>  
> I have no idea why you're churning out targetedId's instead, but if you turn the logging to DEBUG for the IdP, you'll see the exact selection logic followed and will be able to determine why.
> 
>  
>  
> Hope this helps,
> 
> Nate.
> 
> -----Original message-----
> From: Ilya Rumyantsev
> Sent: Monday, October 8 2018, 5:31 am
> To: users at shibboleth.net
> Subject:
>  
> Hi all, from a service provider I am getting the following error message:
> 
>     SimpleSAML_Error_Exception: This service needs at least one of the following
> 		attributes to identity users: eduPersonTargetedID, facebook_targetedID, google_eppn, linkedin_targetedID, twitter_targetedID. Unfortunately not
> 		one of them was detected. Please ask your institution administrator to release one of
> 		them, or try using another identity provider.
> 
> I have the following settings in saml-nameid.properties
> 
>      idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
>      idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier
> 
>      idp.transientId.generator = shibboleth.CryptoTransientIdGenerator
> 
>      idp.persistentId.sourceAttribute = eduPersonTargetedID
> 
> 
> the `shibboleth.SAML2PersistentGenerator` bean is uncommented in saml-nameid.xml and the attribute filter is set to release this attribute.
> 
> If I look into my assertion, I see 
> 
>     <saml2:NameID
>        Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
> 
> Which I don't understand as I have set it to persistent as default value.
> 
> What am I missing?
> Thanks a lot
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net> 
> 
> 
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net