InvalidNameIDPolicy occurs when using multi-factor authentication

[Noriyuki TAKEI]

Hi,All.

Thanks to your advices, I solved this problem.

I added statements marked "added" as below to mfa-authn-config.xml.

resCtx =
input.getSubcontext("net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext",true);
resCtx.setPrincipal(usernameLookupStrategy.apply(input));
resCtx.getRequestedIdPAttributeNames().add("mfaTotpAuthnUseFlag");
resCtx.getRequestedIdPAttributeNames().add("ImmutableID"); // added
resCtx.getRequestedIdPAttributeNames().add("o365UserPrincipalName"); //
added

But this way makes me add all attributes defined by attribute-rexolver.xml.

Is there any way to add an attribute to AttributeResolutionContext
automatically
when new attributes are added to attributes-resolver.xml?

2019年2月4日(月) 18:43 Rod Widdowson <rdw at steadingsoftware.com>:

> So.  Here is your problem:
>
> 1) myLDAP produces three attributes mail, displayName, givenName
>
> > 2019-02-04 00:34:06,103 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] -
> > Data Connector 'myLDAP': Attribute 'mail': Values
> '[StringAttributeValue{value=XXX at example.com}]'
> > 2019-02-04 00:34:06,104 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] -
> > Data Connector 'myLDAP': Attribute 'displayName': Values
> '[StringAttributeValue{value=XXX XXX}]'
> > 2019-02-04 00:34:06,105 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] -
> > Data Connector 'myLDAP': Attribute 'givenName': Values
> '[StringAttributeValue{value=XXX}]'
>
> Your configuration needs "ImmutableId".  But it isn't there
>
> > 2019-02-03 15:26:47,470 - INFO
> [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:227]
> -
> > Attribute sources [ImmutableID] did not produce a usable identifier
>
> So why isn't your LDAP resolver providing this value.  Only you can tell.
> Nate and I both believe its to do with what you are feeding in to it but
> that is a guess.
>
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190204/1058c49e/attachment.html>