InvalidNameIDPolicy occurs when using multi-factor authentication

[Noriyuki TAKEI]

I'm sorry for giving you enough information.

I'd like to send SAML Response including
NameID as format "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent",
so defined saml-nameid.xml as described below:

<util:list id="shibboleth.SAML2NameIDGenerators">
  <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
    p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
    p:attributeSourceIds="#{ {'ImmutableID'} }" />
</util:list>

And then, Office365 that I'd like to send SAML Response to requires
two attributes "UserPrincipalName" and "ImmutableID".
UserPrincipalName is username which identifies a user in Office365.
ImmutableID is one which identifies a user in whole office365 tenants
for single-sign-on.So I defined attribute-filter.xml as described below.

<AttributeFilterPolicy id="PolicyForOffice365">
  <PolicyRequirementRule xsi:type="Requester"
value="urn:federation:MicrosoftOnline"/>

    <AttributeRule attributeID="o365UserPrincipalName">
        <PermitValueRule xsi:type="ANY"/>
    </AttributeRule>

    <AttributeRule attributeID="ImmutableID">
        <PermitValueRule xsi:type="ANY"/>
    </AttributeRule>

    <AttributeRule attributeID="transientId">
        <DenyValueRule xsi:type="ANY" />
    </AttributeRule>
</AttributeFilterPolicy>

I defined attribute-resolver.xml as described as below.

<AttributeDefinition id="o365UserPrincipalName" xsi:type="Simple"
sourceAttributeID="mail">
    <Dependency ref="myLDAP" />
    <AttributeEncoder xsi:type="SAML2String" name="IDPEmail"
friendlyName="UserId" />
</AttributeDefinition>

<AttributeDefinition id="ImmutableID" xsi:type="Simple"
sourceAttributeID="uid">
    <Dependency ref="myLDAP" />
    <AttributeEncoder xsi:type="SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
</AttributeDefinition>

ImmutableID is an attribute I have to send Office365 as NameID, and
it requires format "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent".

When not using multi-factor authentication(define "idp.authn.flows=
password" in idp.properties),
it works fine.

But when using multi-factor authentication(define "idp.authn.flows= MFA" in
idp.properties),
it does not work as I expected.

Exactly, after authenticated via Shibboleth IdP, I got the following error
shown on Office365:

AADSTS500082: SAML assertion is not present in the token.

I picked up some errors from idp-process.log that may causes the
above-mentioned error.

2019-02-03 15:26:47,463 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:286] - Profile
Action AddNameIDToSubjects: Attempting to add NameID to outgoing Assertion
Subjects
2019-02-03 15:26:47,465 - DEBUG
[org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:215]
- Applying policy to NameIDPolicy with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2019-02-03 15:26:47,466 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:316] - Profile
Action AddNameIDToSubjects: Request specified NameID format:
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2019-02-03 15:26:47,467 - DEBUG
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:396] - Profile
Action AddNameIDToSubjects: Trying to generate NameID with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2019-02-03 15:26:47,468 - DEBUG
[org.opensaml.saml.common.profile.impl.ChainingNameIdentifierGenerator:106]
- Trying to generate identifier with Format
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
2019-02-03 15:26:47,469 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:197]
- Checking for source attribute ImmutableID
2019-02-03 15:26:47,470 - INFO
[net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:227]
- Attribute sources [ImmutableID] did not produce a usable identifier
2019-02-03 15:26:47,470 - DEBUG
[org.opensaml.saml.saml2.profile.AbstractSAML2NameIDGenerator:92] - No
identifier to use
2019-02-03 15:26:47,471 - WARN
[org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:337] - Profile
Action AddNameIDToSubjects: Request specified use of an unsupportable
identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:per
sistent
2019-02-03 15:26:47,496 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: InvalidNameIDPolicy
2019-02-03 15:26:47,497 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] -
Error event InvalidNameIDPolicy will be handled with response


I found the following statement in SAML Response which was sent to
Office365 in idp-process.log.

<saml2p:Status>
    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
        <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
    </saml2p:StatusCode>
    <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
</saml2p:Status>

Are there enough informations to solve this problem?



2019年2月2日(土) 3:21 Cantor, Scott <cantor.2 at osu.edu>:

> > Do you have any solutions?
>
> That's a virtually impossible scenario, so either you're mistaking the
> actual situation, or you have strangely different attribute resolution
> outcomes depending on how authentication was done. It's possible
> authentication isn't working at all and it may be mis-reporting the wrong
> error status in the resulting message, but I don't think it would do that.
>
> You provided no logs or specifics, so nothing to base any informed guess
> on.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190203/32bbb40c/attachment.html>