Azure AD and shibboleth IdP integration

Wed Feb 3 09:48:00 UTC 2021

Hi Matthew, thank you for your reply. I made the changes as suggested by you, restarted the service, but the problem persist. I am appending a few lines from the idp-process.log file for your perusal.

With regards, Francis

2021-02-03 15:10:48,848 - 10.0.7.7 - ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail
2021-02-03 15:10:48,850 - 10.0.7.7 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set
2021-02-03 15:10:48,850 - 10.0.7.7 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2021-02-03 15:10:48,850 - 10.0.7.7 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:312] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2021-02-03 15:10:48,851 - 10.0.7.7 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
2021-02-03 15:10:49,046 - 10.0.7.7 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message context
2021-02-03 15:10:49,047 - 10.0.7.7 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2021-02-03 15:10:49,069 - 10.0.7.7 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:78] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2021-02-03 15:10:49,092 - 10.0.7.7 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action RecordResponseComplete: Record response complete
2021-02-03 15:10:49,093 - 10.0.7.7 - INFO [Shibboleth-Audit.SSO:282] - 10.0.7.7|2021-02-03T09:40:19.339283Z,2021-02-03T09:40:19.083539Z|2021-02-03T09:40:49.093209Z||https://iam.atypon.com/shibboleth|||||||false|false||POST|POST||Requester|urn:oasis:names:tc:SAML:2.0:status:AuthnFailed||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36

________________________________
From: Matthew Slowe <Matthew.Slowe at jisc.ac.uk>
Sent: 03 February 2021 14:28
To: Francis Jayakanth <francis at iisc.ac.in>
Cc: Shib Users <users at shibboleth.net>
Subject: Re: Azure AD and shibboleth IdP integration

External Email

Hi Francis,

It looks like the c14n (canonicalisation) flows aren't picking up a suitable subject for some reason.

Following Chris's guide, when doing pure proxying, we've noticed that you also need to enable (uncomment) this bean in subject-c14n.xml:

<bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" />

Try that (and restart) and see if it sorts it.

Regards,
--
Matthew Slowe (GPG: 0x6BE0CF7D04600314)
Senior Technical Consultant and Support specialist - Trust & Identity, Jisc
Team: 0300 300 2212, option 2
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG

> On 2 Feb 2021, at 16:29, Francis Jayakanth <francis at iisc.ac.in> wrote:
>
> Hi Mathew, thank you for your reply. We are still struggling to configure and integrate our IdP 4.0.1 with the Azure AD. I just wanted to let you know that I can access the IEEE platform with the existing IdP configuration. Except for IEEE, the rest of the platforms are reporting an error.
>
> As suggested by you, I have enabled the DEBUG mode of logging,  and the corresponding error log file is accessible at the link given below. I request you to have a look at the log file and give your valuable suggestions to overcome the issues.
>
> Thanks, and regards, Francis
>
> idp-process.log
> From: Matthew Slowe <Matthew.Slowe at jisc.ac.uk>
> Sent: 01 February 2021 16:22
> To: Shib Users <users at shibboleth.net>
> Cc: Francis Jayakanth <francis at iisc.ac.in>
> Subject: Re: Azure AD and shibboleth IdP integration
>
> External Email
>
>
> > On 1 Feb 2021, at 06:00, Raja V, Scientist - C (CS) <raja at inflibnet.ac.in> wrote:
> >
> > Hi,
> > We are trying to integrate Azure AD with shibboleth by following document available athttps://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD
> >
> > However, after authentication, we are getting the following error. Can anyone help us out?
> >
> > ...snip...
> > [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
>
> Hi,
>
> At a guess, you're not getting the attribute you expect either because it's not mapped correctly (Proxy Task 3) or the Attribute Filter isn't allowing the incoming attributes in the filter through (Proxy Task 2).
>
> It's probably worth turning up the logging to DEBUG and following it through looking for where the attributes either aren't found or are filtered out.
>
> I might be wrong though!
> --
> Matthew Slowe (GPG: 0x6BE0CF7D04600314)
> Senior Technical Consultant and Support specialist - Trust & Identity, Jisc
> Team: 0300 300 2212, option 2
> Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210203/fa096f8b/attachment.htm>