[External] Azure AD and shibboleth IdP integration

[Bickel, David]

Hi,

 

The main issue I have found with Azure proxy is that Azure does not send format information to the IDP.  Thus you need to specify the format as unspecified when you setup an encoder.  Please see my below example where I am creating prxAttrib with the saml2.nameFormat= urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified.  

 

Thanks,

--David

 

--Example attrib.properties encoder--

id=prxAttrib
transcoder=SAML2ScopedStringTranscoder
saml2.name=urn:oid:Attribute
saml2.nameFormat=urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
saml2.encodeType=false

 

 

From: users <users-bounces at shibboleth.net> on behalf of "Raja V, Scientist - C (CS)" <raja at inflibnet.ac.in>
Reply-To: Shib Users <users at shibboleth.net>
Date: Monday, February 1, 2021 at 1:00 AM
To: Shib Users <users at shibboleth.net>
Cc: Francis Jayakanth <Francis at iisc.ac.in>
Subject: [External] Azure AD and shibboleth IdP integration

 

This message was sent from a non-IU address. Please exercise caution when clicking links or opening attachments from external sources.

 

Hi,

We are trying to integrate Azure AD with shibboleth by following document available at https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD

 

However, after authentication, we are getting the following error. Can anyone help us out?

 

2021-02-01 11:21:53,314 - 10.0.7.6 - INFO [Shibboleth-Audit.SSO:282] - 10.0.7.6||2021-02-01T05:51:53.314018Z||https://sts.windows.net******/|_282b0ffa-9537-4b9c-9444-bbaf4bee7700|password|2021-02-01T04:42:10.204Z|azureObjectidentifier,azureIdentityprovider,azureGivenname,azureDisplayname,azureAuthnmethodsreferences,azureTenantid,azureEmailaddress,azureSurname|email@email.org|emailAddress||false||Redirect|POST||Success|||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36
2021-02-01 11:21:53,388 - 10.0.7.6 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail
2021-02-01 11:21:53,390 - 10.0.7.6 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set
2021-02-01 11:21:53,390 - 10.0.7.6 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
                                                     

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210201/237ae43a/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5196 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210201/237ae43a/attachment.p7s>