Problem with urn:oasis:names:tc:SAML:2.0:nameid-format:persistent?

[Nate Klingenstein]

Phil,

Odds are that you haven't configured your IdP to be able to send persistent nameID's:

> 2021-01-09 15:23:47,561 - 10.10.26.0 - WARN [org.opensaml.saml.saml2.profile.impl.AddNameIDToSubjects:334] - Profile Action AddNameIDToSubjects: Request specified use of an unsupportable identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

As indicated by your snippet of saml-nameid.xml.

>         <!-- Uncommenting this bean requires configuration in saml-nameid.properties. -->
> 
>         <!--
> 
>                      <ref bean="shibboleth.SAML2PersistentGenerator" />
> 
>         -->

As such, the IdP is unable to generate the requested NameID format and meet the policy requirements of the SP with which it's attempting to communicate, causing it to error out.  You'll need to follow the appropriate steps to enable the generation of persistent NameID's.  It's a slightly tricky topic, so be sure to follow the documentation closely.

https://wiki.shibboleth.net/confluence/display/IDP4/PersistentNameIDGenerationConfiguration

If the service actually requires persistent NameID's, then you'll need to go through full configuration and understanding of them.  If it doesn't and it's misusing the standard(which is fairly common in deployment), then you can put a hack in place(ill-advised in most cases), or reconfigure the service's metadata/AuthnRequest to require a different NameID format.

Best wishes,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id